";
+ assert!(found(
+ 7,
+ "click here to continue (http://evil.example/x)",
+ Some("mail.html"),
+ html
+ ));
+ // Found by its content too, with no name.
+ assert!(found(
+ 7,
+ "click here to continue (http://evil.example/x)",
+ None,
+ html
+ ));
+ // A link whose label names another site.
+ let spoof = b"https://www.paypal.com/login";
+ assert!(found(
+ 7,
+ "https://www.paypal.com/login (https://evil.example/steal)",
+ None,
+ spoof
+ ));
+}
+
+fn phishing(name: &str, file: &[u8], alert: bool) -> Verdict {
+ let mut o = ScanOptions::default();
+ o.filename = Some(name.to_string());
+ o.alert_phishing = alert;
+ analyze(&scanner(7, "never present"), file, &o).verdict
+}
+
+#[test]
+fn a_link_that_says_one_site_and_goes_to_another_is_phishing_in_markdown_too() {
+ let md = b"Sign in at [https://www.paypal.com/login](https://evil.example/steal) today\n";
+ match phishing("mail.md", md, true) {
+ Verdict::Infected { signature, .. } => {
+ assert_eq!(signature, "Heuristics.Phishing.Email.SpoofedDomain")
+ }
+ v => panic!("{v:?}"),
+ }
+ // Off unless asked for, as for HTML.
+ assert!(matches!(phishing("mail.md", md, false), Verdict::Clean));
+ // A link that is what it says is not.
+ assert!(matches!(
+ phishing(
+ "mail.md",
+ b"[www.paypal.com](https://www.paypal.com/login)\n",
+ true
+ ),
+ Verdict::Clean
+ ));
+ // Nor a label that names no site.
+ assert!(matches!(
+ phishing("mail.md", b"[click here](https://evil.example/x)\n", true),
+ Verdict::Clean
+ ));
+}
+
+#[test]
+fn an_html_link_whose_target_is_written_in_entities_is_judged_as_it_reads() {
+ // The raw anchor reader sees `https://...`; the page reads `https://...`.
+ let html = b"www.paypal.com";
+ assert!(matches!(
+ phishing("mail.html", html, true),
+ Verdict::Infected { .. }
+ ));
+}
+
+#[test]
+fn the_parts_of_an_office_file_are_matched_by_their_path() {
+ let part = b"Please download the attachment";
+ let sig = scanner(7, "please download the attachment");
+ let docx = zip_with("word/document.xml", part);
+ let other = zip_with("word/other.xml", part);
+ assert!(matches!(
+ verdict(&sig, None, &docx, false),
+ Verdict::Infected { .. }
+ ));
+ assert!(matches!(verdict(&sig, None, &other, false), Verdict::Clean));
+}
+
+#[test]
+fn a_drawings_text_is_matched_without_its_formatting() {
+ let dxf = " 0\nSECTION\n 2\nENTITIES\n 0\nMTEXT\n 8\n0\n 10\n0.0\n 20\n0.0\n 30\n0.0\n 40\n2.5\n 1\nPay\\Pnow\n 0\nENDSEC\n 0\nEOF\n";
+ assert!(found(7, "pay now", Some("plan.dxf"), dxf.as_bytes()));
+ assert!(!found(7, "pay now", Some("plan.txt"), b"Pay\\Pnow"));
+}
+
+#[test]
+fn an_object_not_held_in_memory_is_not_reported_clean_when_it_has_text() {
+ let db = scanner(7, "never present");
+ // An HTML page: binary objects get no text view for the size to matter to.
+ let mut page = b"
words
".to_vec();
+ page.resize(16 * 1024, b' ');
+ let verdict = |max: u64| {
+ let mut o = ScanOptions::default();
+ o.deep_analysis_max = max;
+ o.filename = Some("page.html".to_string());
+ analyze(&db, &page, &o).verdict
+ };
+ assert!(matches!(verdict(1 << 20), Verdict::Clean));
+ // `analyze` holds the bytes whatever the limit; a larger input is read through a cache.
+ let mut o = ScanOptions::default();
+ o.deep_analysis_max = 4096;
+ o.filename = Some("page.html".to_string());
+ let v = exav_core::scan_seekable(
+ &db,
+ std::io::Cursor::new(page.clone()),
+ page.len() as u64,
+ &o,
+ )
+ .expect("scan")
+ .verdict;
+ assert!(!matches!(v, Verdict::Clean), "{v:?}");
+}
diff --git a/crates/exav-core/tests/suites/visible_text_office.rs b/crates/exav-core/tests/suites/visible_text_office.rs
new file mode 100644
index 0000000..e3e4cec
--- /dev/null
+++ b/crates/exav-core/tests/suites/visible_text_office.rs
@@ -0,0 +1,138 @@
+//! The office formats' text (`visible-text-office`): a DOC, an XLS, a PPT, an
+//! RTF, a flat OpenDocument file is matched through the words a reader sees,
+//! its links are judged, and one whose text cannot be taken out is never
+//! reported clean.
+
+use exav_core::{analyze, loader, ScanOptions, Scanner, Verdict};
+
+const DOC: &[u8] = include_bytes!("../../../exav-render/tests/fixtures/office/docs/sample.doc");
+const XLS: &[u8] = include_bytes!("../../../exav-render/tests/fixtures/office/sheets/sample.xls");
+const PPT: &[u8] = include_bytes!("../../../exav-render/tests/fixtures/office/slides/sample.ppt");
+
+/// A one-signature database: `Target:7`, which a text view alone matches.
+fn scanner(body: &str) -> Scanner {
+ let hex: String = body.bytes().map(|b| format!("{b:02x}")).collect();
+ let mut l = loader::Builder::new();
+ l.add_named_bytes(
+ "t.ndb",
+ format!("Test.Visible:7:*:{hex}\n").as_bytes(),
+ true,
+ );
+ l.build().unwrap()
+}
+
+fn verdict(db: &Scanner, name: &str, file: &[u8], phishing: bool) -> Verdict {
+ let mut o = ScanOptions::default();
+ o.filename = Some(name.to_string());
+ o.alert_phishing = phishing;
+ analyze(db, file, &o).verdict
+}
+
+fn found(words: &str, name: &str, file: &[u8]) -> bool {
+ matches!(
+ verdict(&scanner(words), name, file, false),
+ Verdict::Infected { .. }
+ )
+}
+
+#[test]
+fn an_rtf_phrase_split_by_its_groups_is_matched_as_the_words() {
+ let rtf = b"{\\rtf1\\ansi Please down{\\b load} the \\i attach\\i0 ment\\par}";
+ assert!(found("please download the attachment", "mail.rtf", rtf));
+ // The words of another document are not there.
+ assert!(!found("please upload the attachment", "mail.rtf", rtf));
+}
+
+#[test]
+fn the_words_of_a_doc_an_xls_and_a_ppt_are_matched() {
+ assert!(found("revenue grew by twelve percent", "report.doc", DOC));
+ assert!(found("merged note across three columns", "budget.xls", XLS));
+ assert!(found("revenue up 12%", "deck.ppt", PPT));
+ // A compound file is read by its name: another one is not read.
+ assert!(!found("revenue up 12%", "deck.bin", PPT));
+}
+
+#[test]
+fn a_flat_opendocument_file_is_matched_without_its_markup() {
+ let fodt = br#"Wire the fundstoday"#;
+ assert!(found("wire the funds today", "invoice.fodt", fodt));
+}
+
+#[test]
+fn a_link_that_says_one_site_and_goes_to_another_is_phishing_in_a_legacy_format_too() {
+ let rtf = b"{\\rtf1\\ansi Sign in: {\\field{\\*\\fldinst HYPERLINK \"https://evil.example/steal\"}{\\fldrslt https://www.paypal.com/login}}\\par}";
+ let db = scanner("never present");
+ match verdict(&db, "mail.rtf", rtf, true) {
+ Verdict::Infected { signature, .. } => {
+ assert_eq!(signature, "Heuristics.Phishing.Email.SpoofedDomain")
+ }
+ v => panic!("{v:?}"),
+ }
+ assert!(matches!(
+ verdict(&db, "mail.rtf", rtf, false),
+ Verdict::Clean
+ ));
+}
+
+/// The sample DOC with its FIB's encrypted flag set.
+fn encrypted_doc() -> Vec {
+ let mut d = DOC.to_vec();
+ // The WordDocument stream starts a sector with the FIB's magic, 0xA5EC.
+ let at = (1..d.len() / 512)
+ .map(|s| s * 512)
+ .find(|&o| d[o] == 0xEC && d[o + 1] == 0xA5)
+ .expect("the FIB");
+ // fEncrypted: bit 8 of the flags word at 0x0A.
+ d[at + 0x0B] |= 0x01;
+ d
+}
+
+#[test]
+fn a_document_whose_text_cannot_be_read_is_not_reported_clean() {
+ let db = scanner("never present");
+ // Read, nothing found: clean.
+ assert!(matches!(
+ verdict(&db, "report.doc", DOC, false),
+ Verdict::Clean
+ ));
+ // Encrypted: its text is not seen, and the scan says so.
+ let v = verdict(&db, "report.doc", &encrypted_doc(), false);
+ assert!(
+ !matches!(v, Verdict::Clean | Verdict::Infected { .. }),
+ "{v:?}"
+ );
+}
+
+#[test]
+fn a_damaged_document_whose_text_cannot_be_taken_out_makes_the_scan_incomplete() {
+ // The FIB's fields erased: the reader refuses it as damaged, and nothing
+ // else in the scan looks at what a reader would see.
+ let mut d = DOC.to_vec();
+ let at = (1..d.len() / 512)
+ .map(|s| s * 512)
+ .find(|&o| d[o] == 0xEC && d[o + 1] == 0xA5)
+ .expect("the FIB");
+ d[at + 0x20..at + 0x60].fill(0xFF);
+ let db = scanner("never present");
+ let v = verdict(&db, "broken.doc", &d, false);
+ assert!(
+ !matches!(v, Verdict::Clean | Verdict::Infected { .. }),
+ "{v:?}"
+ );
+ // The same bytes under a name that is not an office document's: read as
+ // nothing, clean.
+ assert!(matches!(
+ verdict(&db, "broken.bin", &d, false),
+ Verdict::Clean
+ ));
+}
+
+#[test]
+fn a_file_that_only_looks_like_a_document_by_its_name_is_not_reported_incomplete() {
+ // Not a compound file at all, under a .doc name: nothing to read.
+ let db = scanner("never present");
+ assert!(matches!(
+ verdict(&db, "notes.doc", b"just some plain words", false),
+ Verdict::Clean
+ ));
+}
diff --git a/crates/exav-grep/Cargo.toml b/crates/exav-grep/Cargo.toml
index d6be113..f5fe5b3 100644
--- a/crates/exav-grep/Cargo.toml
+++ b/crates/exav-grep/Cargo.toml
@@ -20,9 +20,22 @@ exav-unpack = { path = "../exav-unpack", version = "0.0.2", default-features = f
regex = "1"
clap = { workspace = true }
walkdir = { workspace = true }
+# The text of a document as a reader sees it (`text` feature): exav-render's
+# `text`: Markdown, HTML, Office and OpenDocument XML parts, PDF and drawings.
+exav-render = { path = "../exav-render", version = "0.0.2", default-features = false, features = ["text"], optional = true }
[features]
-default = ["decrypt"]
+default = ["decrypt", "text"]
+# `--text`: search the text a reader sees rather than the bytes, for the
+# formats that have one (Markdown, HTML, Office and OpenDocument XML parts,
+# PDF, drawings).
+text = ["dep:exav-render"]
+# And PDF's, read by hayro.
+text-pdf = ["text", "exav-render/text-pdf"]
+# And the office formats the XML parts do not reach: DOC, XLS, PPT, RTF, Word
+# 2003 XML, SpreadsheetML 2003, SYLK, flat OpenDocument, Numbers, Pages and
+# Keynote, by sheet, slide and part. The largest readers: not a default.
+text-office = ["text", "exav-render/text-office"]
# Decrypt encrypted members (ZIP/7z/DMG/Office) so their contents are searchable
# rather than reported as unreadable.
decrypt = ["exav-unpack/decrypt"]
diff --git a/crates/exav-grep/src/lib.rs b/crates/exav-grep/src/lib.rs
index ac0a8b3..e574428 100644
--- a/crates/exav-grep/src/lib.rs
+++ b/crates/exav-grep/src/lib.rs
@@ -103,6 +103,14 @@ pub struct Options {
pub max_count: usize,
/// Treat a member as binary and report only that it matched, not the line.
pub binary_as_matches: bool,
+ /// Search the text a reader sees rather than the bytes, for a member that
+ /// has one: Markdown, HTML, the XML parts of Office and OpenDocument files,
+ /// PDF and drawings are searched as their words, with entities decoded and
+ /// each link followed by where it goes, under the path `file.md!text`, its
+ /// line numbers being the text's. A document that is also a container (a
+ /// PDF, a drawing) is walked for its members as before. Does nothing
+ /// without the `text` feature.
+ pub text: bool,
}
/// One result of the search.
@@ -280,8 +288,8 @@ impl Searcher {
});
}
let Some(fmt) = exav_unpack::detect(&data).or_else(|| packed_executable(data)) else {
- // A leaf: search its bytes.
- return self.search_one(label, data, sink);
+ // A leaf: search its bytes, or its text.
+ return self.search_leaf(label, data, sink);
};
// A container is searched through its MEMBERS, not its raw bytes — for a
// stored member those are the same bytes, and reporting both would
@@ -350,9 +358,88 @@ impl Searcher {
if keep_going && members == 0 {
return self.search_one(label, data, sink);
}
+ // A container with text of its own (a PDF, a drawing) is searched as
+ // that too, besides its members.
+ #[cfg(feature = "text")]
+ if keep_going && self.opts.text {
+ if let Some(go) = self.search_text(label, data, sink) {
+ return go;
+ }
+ }
keep_going
}
+ /// Search a leaf: its text under `--text` when it has one, else its bytes.
+ fn search_leaf(&mut self, label: &str, data: &[u8], sink: Sink) -> bool {
+ #[cfg(feature = "text")]
+ if self.opts.text {
+ if let Some(go) = self.search_text(label, data, sink) {
+ return go;
+ }
+ }
+ self.search_one(label, data, sink)
+ }
+
+ /// Search the text a reader sees in `data`, as `label!text` (and
+ /// `label!text/` for a sheet or a slide), when it is a kind of
+ /// document that has some (`None` when it is not, and also when its text
+ /// could not be taken out: that is reported unreadable and its bytes are
+ /// searched instead). A text cut short is reported unreadable, as a
+ /// member that failed part way is.
+ #[cfg(feature = "text")]
+ fn search_text(&mut self, label: &str, data: &[u8], sink: Sink) -> Option {
+ let name = label.rsplit(NESTING_SEP).next().unwrap_or(label);
+ let cap = usize::try_from(self.opts.limits.max_buffer_bytes).unwrap_or(usize::MAX);
+ let cap = data
+ .len()
+ .saturating_mul(4)
+ .saturating_add(64 << 10)
+ .min(cap);
+ let visible = exav_render::text::visible_text(name, data, cap, &self.opts.limits)?;
+ let path = format!("{label}{NESTING_SEP}text");
+ if let Some(why) = &visible.unreadable {
+ // A document of a kind that has text whose text could not be
+ // taken out: said, and its bytes are searched instead.
+ self.unreadable += 1;
+ if !sink(Event::Unreadable {
+ path,
+ reason: format!("visible text: {why}"),
+ }) {
+ return Some(false);
+ }
+ return None;
+ }
+ // One search to a section (a sheet, a slide), so that a match says
+ // where it is: `book.xls!text/sheet "Budget"`; what comes before the
+ // first section, and a document of one block, is `!text`.
+ let mut at = 0;
+ let mut parts: Vec<(String, std::ops::Range)> = Vec::new();
+ for (section, range) in &visible.sections {
+ if range.start > at {
+ parts.push((path.clone(), at..range.start));
+ }
+ parts.push((format!("{path}/{section}"), range.clone()));
+ at = range.end;
+ }
+ if at < visible.text.len() || parts.is_empty() {
+ parts.push((path.clone(), at..visible.text.len()));
+ }
+ for (part, range) in parts {
+ let bytes = visible.text.as_bytes().get(range).unwrap_or_default();
+ if !self.search_one(&part, bytes, sink) {
+ return Some(false);
+ }
+ }
+ if visible.truncated {
+ self.unreadable += 1;
+ return Some(sink(Event::Unreadable {
+ path,
+ reason: format!("visible text cut at {cap} bytes"),
+ }));
+ }
+ Some(true)
+ }
+
/// Line-match a single object's bytes.
fn search_one(&mut self, path: &str, data: &[u8], sink: Sink) -> bool {
if looks_binary(data) {
diff --git a/crates/exav-grep/src/main.rs b/crates/exav-grep/src/main.rs
index 2dacb59..070b426 100644
--- a/crates/exav-grep/src/main.rs
+++ b/crates/exav-grep/src/main.rs
@@ -101,6 +101,15 @@ struct Cli {
/// hiding them turns "I couldn't look" into an indistinguishable "no match".
#[arg(long)]
quiet_unreadable: bool,
+
+ /// Search the text a reader sees rather than the bytes, for the files that
+ /// have one: Markdown, HTML, Office and OpenDocument XML parts, PDF and
+ /// drawings (DXF, DWG). Entities are decoded and each link is followed by
+ /// where it goes; matches are reported under `file.md!text`, with the
+ /// text's line numbers.
+ #[cfg(feature = "text")]
+ #[arg(long)]
+ text: bool,
}
fn main() -> ExitCode {
@@ -137,6 +146,10 @@ fn main() -> ExitCode {
after_context: cli.after_context.max(ctx),
max_count: cli.max_count,
binary_as_matches: true,
+ #[cfg(feature = "text")]
+ text: cli.text,
+ #[cfg(not(feature = "text"))]
+ text: false,
};
let mut searcher = Searcher::new(matcher, opts);
diff --git a/crates/exav-grep/tests/text.rs b/crates/exav-grep/tests/text.rs
new file mode 100644
index 0000000..bf90bea
--- /dev/null
+++ b/crates/exav-grep/tests/text.rs
@@ -0,0 +1,178 @@
+//! `--text`: a Markdown file is searched as the text a reader sees.
+
+#![cfg(feature = "text")]
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+const BIN: &str = env!("CARGO_BIN_EXE_exav-grep");
+
+/// A scratch directory unique to one test, removed when the test ends.
+struct Scratch(PathBuf);
+
+impl Scratch {
+ fn new(tag: &str) -> Self {
+ let d = std::env::temp_dir().join(format!("exav-grep-text-{}-{tag}", std::process::id()));
+ let _ = std::fs::remove_dir_all(&d);
+ std::fs::create_dir_all(&d).expect("scratch dir");
+ Scratch(d)
+ }
+
+ fn write(&self, name: &str, bytes: &[u8]) -> PathBuf {
+ let p = self.0.join(name);
+ std::fs::write(&p, bytes).expect("write fixture");
+ p
+ }
+}
+
+impl Drop for Scratch {
+ fn drop(&mut self) {
+ let _ = std::fs::remove_dir_all(&self.0);
+ }
+}
+
+fn run(args: &[&str], file: &Path) -> Output {
+ Command::new(BIN)
+ .args(args)
+ .arg(file)
+ .output()
+ .expect("spawn exav-grep")
+}
+
+fn code(o: &Output) -> i32 {
+ o.status.code().expect("exited normally, not by signal")
+}
+
+fn stdout(o: &Output) -> String {
+ String::from_utf8_lossy(&o.stdout).into_owned()
+}
+
+/// Minimal stored-member ZIP (local headers only: exav reads those).
+fn zip_of(name: &str, body: &[u8]) -> Vec {
+ let mut v = Vec::new();
+ v.extend_from_slice(b"PK\x03\x04");
+ for n in [20u16, 0, 0, 0, 0] {
+ v.extend_from_slice(&n.to_le_bytes());
+ }
+ v.extend_from_slice(&0u32.to_le_bytes());
+ v.extend_from_slice(&(body.len() as u32).to_le_bytes());
+ v.extend_from_slice(&(body.len() as u32).to_le_bytes());
+ v.extend_from_slice(&(name.len() as u16).to_le_bytes());
+ v.extend_from_slice(&0u16.to_le_bytes());
+ v.extend_from_slice(name.as_bytes());
+ v.extend_from_slice(body);
+ v
+}
+
+#[test]
+fn words_split_by_marks_are_found_only_with_text() {
+ let s = Scratch::new("marks");
+ let f = s.write(
+ "notes.md",
+ b"# Title\n\nPlease *download* the **new** version.\n",
+ );
+ let with = run(&["--text", "-F", "Please download the new version"], &f);
+ assert_eq!(code(&with), 0, "{}", stdout(&with));
+ assert_eq!(
+ stdout(&with),
+ format!("{}!text:2:Please download the new version.\n", f.display())
+ );
+ // Without it, the bytes are searched, marks and all.
+ assert_eq!(
+ code(&run(&["-F", "Please download the new version"], &f)),
+ 1
+ );
+ // And what is in the bytes still is, with it, only as the reader sees it.
+ assert_eq!(code(&run(&["--text", "-F", "**new**"], &f)), 1);
+}
+
+#[test]
+fn a_link_is_followed_by_where_it_goes_and_an_entity_is_decoded() {
+ let s = Scratch::new("links");
+ let f = s.write(
+ "a.markdown",
+ b"Sign in at [https://www.paypal.com/login](https://evil.example/steal) & pay\n",
+ );
+ let o = run(&["--text", "evil.example/steal"], &f);
+ assert_eq!(code(&o), 0);
+ assert!(
+ stdout(&o).contains("https://www.paypal.com/login (https://evil.example/steal) & pay"),
+ "{}",
+ stdout(&o)
+ );
+}
+
+#[test]
+fn a_member_of_an_archive_is_searched_by_its_own_name() {
+ let s = Scratch::new("zip");
+ let body = b"Please *download* it\n";
+ let md = s.write("a.zip", &zip_of("docs/readme.md", body));
+ let o = run(&["--text", "-F", "Please download it"], &md);
+ assert_eq!(code(&o), 0);
+ assert_eq!(
+ stdout(&o),
+ format!(
+ "{}!docs/readme.md!text:1:Please download it\n",
+ md.display()
+ )
+ );
+ let txt = s.write("b.zip", &zip_of("docs/readme.txt", body));
+ assert_eq!(code(&run(&["--text", "-F", "Please download it"], &txt)), 1);
+}
+
+#[test]
+fn html_is_searched_without_its_tags() {
+ let s = Scratch::new("html");
+ let f = s.write(
+ "page.html",
+ b"
",
+ );
+ let o = run(
+ &[
+ "--text",
+ "-F",
+ "Click here to go on (http://evil.example/x)",
+ ],
+ &f,
+ );
+ assert_eq!(code(&o), 0, "{}", stdout(&o));
+ assert_eq!(
+ stdout(&o),
+ format!(
+ "{}!text:1:Click here to go on (http://evil.example/x)\n",
+ f.display()
+ )
+ );
+ assert_eq!(code(&run(&["-F", "Click here to go on"], &f)), 1);
+}
+
+#[cfg(feature = "text-pdf")]
+#[test]
+fn a_pdf_is_searched_as_its_text_besides_its_streams() {
+ let s = Scratch::new("pdf");
+ let content = "BT /F1 12 Tf 72 700 Td [(Pay to ev) 10 (il.exa) 5 (mple)] TJ ET";
+ let pdf = format!(
+ "%PDF-1.4\n1 0 obj<>endobj\n2 0 obj<>endobj\n\
+ 3 0 obj<>>>/Contents 4 0 R>>endobj\n\
+ 4 0 obj<>\nstream\n{content}\nendstream\nendobj\n\
+ 5 0 obj<>endobj\ntrailer<>\n%%EOF\n",
+ content.len()
+ );
+ let f = s.write("doc.pdf", pdf.as_bytes());
+ let o = run(&["--text", "-F", "Pay to evil.example"], &f);
+ assert_eq!(code(&o), 0, "{}", stdout(&o));
+ assert_eq!(
+ stdout(&o),
+ format!("{}!text:1:Pay to evil.example\n", f.display())
+ );
+ assert_eq!(code(&run(&["-F", "Pay to evil.example"], &f)), 1);
+}
+
+#[test]
+fn other_files_are_searched_as_they_are() {
+ let s = Scratch::new("other");
+ let f = s.write("notes.txt", b"a *b* c\n");
+ let o = run(&["--text", "-F", "a *b* c"], &f);
+ assert_eq!(code(&o), 0);
+ assert_eq!(stdout(&o), format!("{}:1:a *b* c\n", f.display()));
+}
diff --git a/crates/exav-grep/tests/text_office.rs b/crates/exav-grep/tests/text_office.rs
new file mode 100644
index 0000000..b811184
--- /dev/null
+++ b/crates/exav-grep/tests/text_office.rs
@@ -0,0 +1,129 @@
+//! `--text` on the office formats the XML parts do not reach: a match says
+//! its sheet or slide, and a document whose text cannot be taken out is
+//! reported unreadable.
+
+#![cfg(feature = "text-office")]
+
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+const BIN: &str = env!("CARGO_BIN_EXE_exav-grep");
+
+const XLS: &[u8] = include_bytes!("../../exav-render/tests/fixtures/office/sheets/sample.xls");
+const PPT: &[u8] = include_bytes!("../../exav-render/tests/fixtures/office/slides/sample.ppt");
+const DOC: &[u8] = include_bytes!("../../exav-render/tests/fixtures/office/docs/sample.doc");
+
+/// A scratch directory unique to one test, removed when the test ends.
+struct Scratch(PathBuf);
+
+impl Scratch {
+ fn new(tag: &str) -> Self {
+ let d = std::env::temp_dir().join(format!("exav-grep-office-{}-{tag}", std::process::id()));
+ let _ = std::fs::remove_dir_all(&d);
+ std::fs::create_dir_all(&d).expect("scratch dir");
+ Scratch(d)
+ }
+
+ fn write(&self, name: &str, bytes: &[u8]) -> PathBuf {
+ let p = self.0.join(name);
+ std::fs::write(&p, bytes).expect("write fixture");
+ p
+ }
+}
+
+impl Drop for Scratch {
+ fn drop(&mut self) {
+ let _ = std::fs::remove_dir_all(&self.0);
+ }
+}
+
+fn run(args: &[&str], file: &Path) -> Output {
+ Command::new(BIN)
+ .args(args)
+ .arg(file)
+ .output()
+ .expect("spawn exav-grep")
+}
+
+fn code(o: &Output) -> i32 {
+ o.status.code().expect("exited normally, not by signal")
+}
+
+fn stdout(o: &Output) -> String {
+ String::from_utf8_lossy(&o.stdout).into_owned()
+}
+
+#[test]
+fn a_match_in_a_workbook_says_its_sheet() {
+ let s = Scratch::new("xls");
+ let f = s.write("budget.xls", XLS);
+ let o = run(&["--text", "-F", "Second sheet"], &f);
+ assert_eq!(code(&o), 0, "{}", stdout(&o));
+ // The text, by sheet (the workbook's own stream is a member too, and its
+ // bytes match as well).
+ let line = format!("{}!text/sheet \"Notes\":2:Second sheet\t1\n", f.display());
+ assert!(stdout(&o).contains(&line), "{}", stdout(&o));
+ assert!(!stdout(&o).contains("sheet \"Budget\""), "{}", stdout(&o));
+ // Another sheet's words are in that sheet.
+ let o = run(&["--text", "-F", "Merged note"], &f);
+ assert!(
+ stdout(&o).contains(&format!("{}!text/sheet \"Budget\":", f.display())),
+ "{}",
+ stdout(&o)
+ );
+}
+
+#[test]
+fn a_match_in_a_presentation_says_its_slide() {
+ let s = Scratch::new("ppt");
+ let f = s.write("deck.ppt", PPT);
+ let o = run(&["--text", "-F", "Second slide text"], &f);
+ assert_eq!(code(&o), 0, "{}", stdout(&o));
+ assert_eq!(
+ stdout(&o),
+ format!("{}!text/slide 2:2:Second slide text\n", f.display())
+ );
+}
+
+#[test]
+fn a_documents_words_are_found_without_its_formatting_and_one_block_is_the_text() {
+ let s = Scratch::new("doc");
+ let f = s.write("report.doc", DOC);
+ let o = run(&["--text", "-F", "costs stayed flat"], &f);
+ assert_eq!(code(&o), 0, "{}", stdout(&o));
+ assert!(
+ stdout(&o).starts_with(&format!("{}!text:", f.display())),
+ "{}",
+ stdout(&o)
+ );
+}
+
+#[test]
+fn an_encrypted_document_is_reported_unreadable_and_its_bytes_are_searched() {
+ let s = Scratch::new("locked");
+ let mut doc = DOC.to_vec();
+ let at = (1..doc.len() / 512)
+ .map(|n| n * 512)
+ .find(|&o| doc[o] == 0xEC && doc[o + 1] == 0xA5)
+ .expect("the FIB");
+ doc[at + 0x0B] |= 0x01;
+ let f = s.write("locked.doc", &doc);
+ let o = run(&["--text", "-F", "no such words"], &f);
+ // No match, and a part that could not be read: the search is incomplete.
+ assert_eq!(code(&o), 3, "{}", stdout(&o));
+ let all = format!("{}{}", stdout(&o), String::from_utf8_lossy(&o.stderr));
+ assert!(
+ all.contains("visible text") && all.contains("ncrypted"),
+ "{all}"
+ );
+}
+
+#[test]
+fn without_text_the_bytes_are_searched_as_before() {
+ let s = Scratch::new("bytes");
+ let f = s.write("deck.ppt", PPT);
+ let o = run(&["-a", "-F", "Second slide text"], &f);
+ // The text is stored as UTF-16 or 8-bit in a compound file: the word
+ // search on bytes may or may not see it, and never says a sheet or a slide.
+ assert!(!stdout(&o).contains("!text"), "{}", stdout(&o));
+}
diff --git a/crates/exav-pe-emu/NOTICE b/crates/exav-pe-emu/NOTICE
index d61ed5d..c0b3d88 100644
--- a/crates/exav-pe-emu/NOTICE
+++ b/crates/exav-pe-emu/NOTICE
@@ -1,7 +1,85 @@
exav-pe-emu: third-party notices
+================================
-This crate is part of exav and contains no third-party source. The notices
-for the components exav links are in the NOTICE file at the root of the exav
-repository, which also ships in every release archive:
+exav-pe-emu is licensed under the MIT License (see LICENSE). This file gives the
+notices for the third-party data in this crate's source. The notices for the
+components the exav binaries link are in the NOTICE file at the root of the
+exav repository: https://github.com/sylvinus/exav/blob/main/NOTICE
-https://github.com/sylvinus/exav/blob/main/NOTICE
+
+Microsoft API documentation, CC BY 4.0 (export name lists)
+----------------------------------------------------------
+
+src/exports/{kernel32,ntdll,user32,advapi32}.txt list the export names the
+synthetic system DLLs advertise. scripts/gen-exports.py, in this crate,
+extracts them from the metadata of Microsoft's API reference pages: for each
+page marked as a DLL export, the function name and the DLLs that export it.
+Nothing else from the pages is used. The lists are a selection and
+rearrangement of that metadata (names only, sorted, one per line). One name is
+added by the script with its reason stated there: ntdll's RtlDecompressBuffer,
+which the documentation records only under NtosKrnl.exe.
+
+Sources, pinned by commit:
+
+ MicrosoftDocs/sdk-api
+ https://github.com/MicrosoftDocs/sdk-api
+ commit 9e0d205d747b5e0f08019cc7e202112c3aa1f68c
+ MicrosoftDocs/windows-driver-docs-ddi
+ https://github.com/MicrosoftDocs/windows-driver-docs-ddi
+ commit 7515063cea4c9e98db6a92986c5b4ddb0463fd16
+
+Copyright (c) Microsoft Corporation.
+
+The documentation is licensed under the Creative Commons Attribution 4.0
+International Public License (CC BY 4.0):
+https://creativecommons.org/licenses/by/4.0/legalcode
+
+The material is provided as-is, without warranties of any kind, as stated in
+section 5 of that licence.
+
+
+Layout facts for the synthetic TEB, PEB, loader lists and KUSER_SHARED_DATA
+---------------------------------------------------------------------------
+
+src/win.rs tags each field it writes with where its offset comes from. No text
+is copied; these are the sources of the facts, all Microsoft documentation
+under the CC BY 4.0 notice above:
+
+ [pe] PE Format specification, "The .tls Section" (TEB+0x2C TLS array)
+ MicrosoftDocs/win32, desktop-src/Debug/pe-format.md,
+ commit 8a9c5d8f32001411f5e572a17e6d736d6fcc055f
+ [dbg] Debugger documentation, `dt` output from 32-bit Windows: TEB NtTib
+ (0x00), ClientId (0x20), ThreadLocalStoragePointer (0x2C),
+ ProcessEnvironmentBlock (0x30); PEB Ldr (0x0C); PEB_LDR_DATA Length
+ (0x28), Initialized (0x04) and its three list heads (0x0C, 0x14, 0x1C).
+ MicrosoftDocs/windows-driver-docs, commit
+ 6de78e042e0eaba466569c7f5ed65c250c644a0b: debugger/
+ debugging-a-stack-overflow.md, debuggercmds/dt--display-type-.md,
+ debuggercmds/c---numbers-and-operators.md
+ [wtl] winternl.h reference: LDR_DATA_TABLE_ENTRY (InMemoryOrderLinks 0x08,
+ DllBase 0x18, FullDllName 0x24, and the positions of the reserved
+ slots at 0x00, 0x10, 0x1C and 0x2C), MicrosoftDocs/sdk-api (commit
+ above), ns-winternl-peb_ldr_data.md
+ [kus] KUSER_SHARED_DATA reference: field order only,
+ MicrosoftDocs/windows-driver-docs-ddi (commit above),
+ ns-ntddk-kuser_shared_data.md
+
+Fields tagged [obs] are not given by these sources. Each holds a value a
+32-bit Windows process can compare against an API that reports the same thing,
+which is how the offset is established:
+
+ TEB 0x00/0x04/0x08 ExceptionList, StackBase, StackLimit: the SEH chain
+ head and the stack bounds of the running thread
+ TEB 0x18 Self: equals the TEB address
+ TEB 0x20/0x24 GetCurrentProcessId(), GetCurrentThreadId()
+ PEB 0x08 GetModuleHandle(NULL)
+ PEB 0x18 GetProcessHeap()
+ PEB 0x64 GetSystemInfo().dwNumberOfProcessors
+ PEB 0x68 global flags as set with gflags for the image
+ PEB 0xA4..0xB0 RtlGetVersion(): major, minor, build, platform id
+ LDR entry 0x00/0x10 walking the load-order and initialisation-order lists
+ reaches the same entries the memory-order list does
+ LDR entry 0x1C/0x20 the module's entry point and SizeOfImage from its headers
+ LDR entry 0x2C the module's file name
+ KUSER 0x00..0x270 GetTickCount(), the system time, the system root and
+ RtlGetVersion() major/minor
diff --git a/crates/exav-pe-emu/scripts/gen-exports.py b/crates/exav-pe-emu/scripts/gen-exports.py
new file mode 100644
index 0000000..afe9fdb
--- /dev/null
+++ b/crates/exav-pe-emu/scripts/gen-exports.py
@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+# Regenerate src/exports/.txt: the export-name sets the synthetic system
+# DLLs advertise, so a stub that resolves imports by hashing export names finds
+# the function it looks for even when the emulator does not implement it.
+#
+# Source: Microsoft's own API documentation, which records for every exported
+# function the DLLs that export it. Each reference page carries YAML front
+# matter with `UID: NF:.` (the exact exported name; ANSI and
+# Unicode variants each have their own page), `api_type: DllExport` and an
+# `api_location` list of DLLs. Only those three fields are read.
+#
+# MicrosoftDocs/sdk-api (Win32 API reference)
+# MicrosoftDocs/windows-driver-docs-ddi (WDK reference; Rtl*/Zw* in ntdll)
+#
+# Both are (c) Microsoft Corporation, documentation licensed under CC BY 4.0.
+# The attribution is in this crate's NOTICE. Nothing else is taken from them.
+#
+# Usage: download the two archives below (any path), then
+# gen-exports.py sdk-api.tar.gz windows-driver-docs-ddi.tar.gz
+# The archives are read in place, never extracted. The commit is the pin; the
+# SHA-256 is of GitHub's tar.gz for that commit as downloaded on 2026-10-18.
+# GitHub does not promise byte-stable archives, so on a hash mismatch rebuild the
+# archive from the pinned commit (`git archive --format=tar.gz`) and re-pin.
+
+import hashlib
+import os
+import re
+import sys
+import tarfile
+
+SOURCES = [
+ {
+ "repo": "MicrosoftDocs/sdk-api",
+ "commit": "9e0d205d747b5e0f08019cc7e202112c3aa1f68c",
+ "url": "https://codeload.github.com/MicrosoftDocs/sdk-api/tar.gz/"
+ "9e0d205d747b5e0f08019cc7e202112c3aa1f68c",
+ "sha256": "7ea18a09a9eb9dc2d50fddc8835f488bb349c6763a2e4eff1d1d3f99a4b53928",
+ },
+ {
+ "repo": "MicrosoftDocs/windows-driver-docs-ddi",
+ "commit": "7515063cea4c9e98db6a92986c5b4ddb0463fd16",
+ "url": "https://codeload.github.com/MicrosoftDocs/windows-driver-docs-ddi/tar.gz/"
+ "7515063cea4c9e98db6a92986c5b4ddb0463fd16",
+ "sha256": "3c3fb42a76ec66aa3b7d61a78901ad1d5612220f9e89847f61ae94a5c11dc2fc",
+ },
+]
+
+# The preloaded DLLs the documentation records exports for. `msvcrt.dll` is
+# absent: the CRT reference does not map functions to it.
+DLLS = ["kernel32.dll", "ntdll.dll", "user32.dll", "advapi32.dll"]
+
+# Names added by hand, each with its justification. The documentation records
+# the DLLs a function is exported from, and a few user-mode ntdll exports are
+# documented only under the kernel.
+ADDED = {
+ "ntdll.dll": [
+ # Documented in the WDK (ntifs.h, nf-ntifs-rtldecompressbuffer) with
+ # api_location NtosKrnl.exe only. ntdll.dll exports it too, and
+ # Alienyze resolves it there by hashing ntdll's export names; without
+ # it the stub skips decompression.
+ "RtlDecompressBuffer",
+ ],
+}
+
+# Cap per module, so a synthetic module's export directory stays inside the
+# region below its trap range (see `MAX_EXPORT_DIR` in src/win.rs).
+MAX_PER_MODULE = 2000
+
+IDENT = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+
+
+def front_matter(text):
+ """The scalar and list fields of a page's leading `---` block."""
+ if not text.startswith("---"):
+ return None
+ end = text.find("\n---", 3)
+ if end < 0:
+ return None
+ fields, key = {}, None
+ for line in text[3:end].splitlines():
+ if line.startswith(" - ") and key is not None:
+ fields.setdefault(key, []).append(line[3:].strip())
+ continue
+ m = re.match(r"([A-Za-z0-9_.-]+):\s*(.*)$", line)
+ if m:
+ key, value = m.group(1), m.group(2).strip()
+ fields[key] = [value] if value else []
+ return fields
+
+
+def exports_in(archive, out):
+ with tarfile.open(archive, "r:gz") as tar:
+ for member in tar:
+ if not member.isfile() or not member.name.endswith(".md"):
+ continue
+ # Reference pages only; a page is a few kilobytes, so anything far
+ # larger is not one and is skipped unread.
+ if member.size > 1 << 20:
+ continue
+ raw = tar.extractfile(member).read().decode("utf-8", "replace")
+ fm = front_matter(raw)
+ if not fm:
+ continue
+ if "DllExport" not in fm.get("api_type", []):
+ continue
+ # VersionHelpers.h functions are inline in the header, not exports,
+ # though their pages list ntdll.dll.
+ if (fm.get("req.header") or [""])[0].lower() == "versionhelpers.h":
+ continue
+ uid = (fm.get("UID") or [""])[0]
+ if not uid.startswith("NF:") or "." not in uid:
+ continue
+ name = uid.rsplit(".", 1)[1]
+ if not IDENT.fullmatch(name) or name not in fm.get("api_name", []):
+ continue
+ for loc in fm.get("api_location", []):
+ dll = loc.strip().lower()
+ if dll in out:
+ out[dll].add(name)
+
+
+def sha256(path):
+ h = hashlib.sha256()
+ with open(path, "rb") as f:
+ for block in iter(lambda: f.read(1 << 20), b""):
+ h.update(block)
+ return h.hexdigest()
+
+
+def main():
+ if len(sys.argv) != len(SOURCES) + 1:
+ sys.exit("usage: gen-exports.py sdk-api.tar.gz windows-driver-docs-ddi.tar.gz")
+ out = {dll: set() for dll in DLLS}
+ for src, path in zip(SOURCES, sys.argv[1:]):
+ got = sha256(path)
+ if got != src["sha256"]:
+ sys.exit(f"{path}: sha256 {got}, expected {src['sha256']} ({src['repo']}@{src['commit']})")
+ exports_in(path, out)
+ for dll, names in ADDED.items():
+ out[dll].update(names)
+ out_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "src", "exports")
+ os.makedirs(out_dir, exist_ok=True)
+ for dll in DLLS:
+ names = sorted(out[dll])[:MAX_PER_MODULE]
+ dest = os.path.join(out_dir, dll.removesuffix(".dll") + ".txt")
+ with open(dest, "w") as f:
+ f.write("".join(n + "\n" for n in names))
+ print(f"{dll}: {len(names)} names")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/crates/exav-pe-emu/src/cpu.rs b/crates/exav-pe-emu/src/cpu.rs
index f060be5..cdce6a5 100644
--- a/crates/exav-pe-emu/src/cpu.rs
+++ b/crates/exav-pe-emu/src/cpu.rs
@@ -1559,7 +1559,8 @@ impl Cpu {
};
self.cf = r & 1 != 0;
if count == 1 {
- self.of = ((r ^ (r << 1)) & sign_bit(size)) != 0;
+ // MSB of the result xor the bit rotated into CF.
+ self.of = (r & sign_bit(size) != 0) != self.cf;
}
r
}
@@ -1592,7 +1593,16 @@ impl Cpu {
}
}
self.cf = (acc >> bits) & 1 != 0;
- (acc as u32) & mask(size)
+ let r = (acc as u32) & mask(size);
+ if count == 1 {
+ let msb = r & sign_bit(size) != 0;
+ self.of = if m == Rcl {
+ msb != self.cf
+ } else {
+ msb != (r & (sign_bit(size) >> 1) != 0)
+ };
+ }
+ r
}
_ => unreachable!("shift dispatch"),
};
@@ -2442,6 +2452,30 @@ mod tests {
assert!(cpu.cf);
}
+ #[test]
+ fn rotate_by_one_sets_overflow_from_the_result() {
+ // OF after a 1-bit rotate is MSB(result) xor CF-bit-rotated. A tElock
+ // decryptor branches on it; getting it wrong sent the stub into an
+ // `EB FE` self-loop. Values checked against a reference x86.
+ // rol: 0x80000000 rol 1 -> CF=1, result MSB=0, so OF = 1 ^ 0 = 1.
+ let (cpu, _) = run(&[0xb8, 0, 0, 0, 0x80, 0xd1, 0xc0], |_| {});
+ assert_eq!(cpu.regs[EAX], 1);
+ assert!(cpu.cf && cpu.of, "rol: CF=1, OF=1");
+ // rol 0x40000000 by 1 -> 0x80000000, CF=0, MSB=1, OF = 1 ^ 0 = 1.
+ let (cpu, _) = run(&[0xb8, 0, 0, 0, 0x40, 0xd1, 0xc0], |_| {});
+ assert_eq!(cpu.regs[EAX], 0x8000_0000);
+ assert!(!cpu.cf && cpu.of, "rol: CF=0, OF=1");
+ // ror 1 of odd value: 0x00000001 -> 0x80000000, CF=1, top two bits
+ // 10, so OF = MSB xor next-bit = 1 ^ 0 = 1.
+ let (cpu, _) = run(&[0xb8, 1, 0, 0, 0, 0xd1, 0xc8], |_| {});
+ assert_eq!(cpu.regs[EAX], 0x8000_0000);
+ assert!(cpu.cf && cpu.of, "ror: CF=1, OF=1");
+ // rcr 1 with CF=0 of 1 -> 0, CF out = 1, both top bits 0, OF = 0.
+ let (cpu, _) = run(&[0xb8, 1, 0, 0, 0, 0xd1, 0xd8], |c| c.cf = false);
+ assert_eq!(cpu.regs[EAX], 0);
+ assert!(cpu.cf && !cpu.of, "rcr: CF=1, OF=0");
+ }
+
#[test]
fn mul_and_div_roundtrip() {
// b8 00 00 10 00 mov eax, 0x100000
diff --git a/crates/exav-pe-emu/src/exports/advapi32.txt b/crates/exav-pe-emu/src/exports/advapi32.txt
new file mode 100644
index 0000000..907e3c8
--- /dev/null
+++ b/crates/exav-pe-emu/src/exports/advapi32.txt
@@ -0,0 +1,541 @@
+AbortSystemShutdownA
+AbortSystemShutdownW
+AccessCheck
+AccessCheckAndAuditAlarmA
+AccessCheckAndAuditAlarmW
+AccessCheckByType
+AccessCheckByTypeAndAuditAlarmA
+AccessCheckByTypeAndAuditAlarmW
+AccessCheckByTypeResultList
+AccessCheckByTypeResultListAndAuditAlarmA
+AccessCheckByTypeResultListAndAuditAlarmByHandleA
+AccessCheckByTypeResultListAndAuditAlarmByHandleW
+AccessCheckByTypeResultListAndAuditAlarmW
+AddAccessAllowedAce
+AddAccessAllowedAceEx
+AddAccessAllowedObjectAce
+AddAccessDeniedAce
+AddAccessDeniedAceEx
+AddAccessDeniedObjectAce
+AddAce
+AddAuditAccessAce
+AddAuditAccessAceEx
+AddAuditAccessObjectAce
+AddConditionalAce
+AddMandatoryAce
+AddUsersToEncryptedFile
+AdjustTokenGroups
+AdjustTokenPrivileges
+AllocateAndInitializeSid
+AllocateLocallyUniqueId
+AreAllAccessesGranted
+AreAnyAccessesGranted
+AuditComputeEffectivePolicyBySid
+AuditComputeEffectivePolicyByToken
+AuditEnumerateCategories
+AuditEnumeratePerUserPolicy
+AuditEnumerateSubCategories
+AuditFree
+AuditLookupCategoryGuidFromCategoryId
+AuditLookupCategoryIdFromCategoryGuid
+AuditLookupCategoryNameA
+AuditLookupCategoryNameW
+AuditLookupSubCategoryNameA
+AuditLookupSubCategoryNameW
+AuditQueryGlobalSaclA
+AuditQueryGlobalSaclW
+AuditQueryPerUserPolicy
+AuditQuerySecurity
+AuditQuerySystemPolicy
+AuditSetGlobalSaclA
+AuditSetGlobalSaclW
+AuditSetPerUserPolicy
+AuditSetSecurity
+AuditSetSystemPolicy
+BackupEventLogA
+BackupEventLogW
+BuildExplicitAccessWithNameA
+BuildExplicitAccessWithNameW
+BuildSecurityDescriptorA
+BuildSecurityDescriptorW
+BuildTrusteeWithNameA
+BuildTrusteeWithNameW
+BuildTrusteeWithObjectsAndNameA
+BuildTrusteeWithObjectsAndNameW
+BuildTrusteeWithObjectsAndSidA
+BuildTrusteeWithObjectsAndSidW
+BuildTrusteeWithSidA
+BuildTrusteeWithSidW
+ChangeServiceConfig2A
+ChangeServiceConfig2W
+ChangeServiceConfigA
+ChangeServiceConfigW
+CheckTokenMembership
+ClearEventLogA
+ClearEventLogW
+CloseEncryptedFileRaw
+CloseEventLog
+CloseServiceHandle
+CloseThreadWaitChainSession
+ControlService
+ControlServiceExA
+ControlServiceExW
+ConvertSecurityDescriptorToStringSecurityDescriptorA
+ConvertSecurityDescriptorToStringSecurityDescriptorW
+ConvertSidToStringSidA
+ConvertSidToStringSidW
+ConvertStringSecurityDescriptorToSecurityDescriptorA
+ConvertStringSecurityDescriptorToSecurityDescriptorW
+ConvertStringSidToSidA
+ConvertStringSidToSidW
+ConvertToAutoInheritPrivateObjectSecurity
+CopySid
+CreatePrivateObjectSecurity
+CreatePrivateObjectSecurityEx
+CreatePrivateObjectSecurityWithMultipleInheritance
+CreateProcessAsUserA
+CreateProcessAsUserW
+CreateProcessWithLogonW
+CreateProcessWithTokenW
+CreateRestrictedToken
+CreateServiceA
+CreateServiceW
+CreateWellKnownSid
+CredDeleteA
+CredDeleteW
+CredEnumerateA
+CredEnumerateW
+CredFindBestCredentialA
+CredFindBestCredentialW
+CredFree
+CredGetSessionTypes
+CredGetTargetInfoA
+CredGetTargetInfoW
+CredIsMarshaledCredentialA
+CredIsMarshaledCredentialW
+CredIsProtectedA
+CredIsProtectedW
+CredMarshalCredentialA
+CredMarshalCredentialW
+CredMarshalTargetInfo
+CredProtectA
+CredProtectW
+CredReadA
+CredReadDomainCredentialsA
+CredReadDomainCredentialsW
+CredReadW
+CredRenameA
+CredRenameW
+CredUnmarshalCredentialA
+CredUnmarshalCredentialW
+CredUnprotectA
+CredUnprotectW
+CredWriteA
+CredWriteDomainCredentialsA
+CredWriteDomainCredentialsW
+CredWriteW
+CryptAcquireContextA
+CryptAcquireContextW
+CryptContextAddRef
+CryptCreateHash
+CryptDecrypt
+CryptDeriveKey
+CryptDestroyHash
+CryptDestroyKey
+CryptDuplicateHash
+CryptDuplicateKey
+CryptEncrypt
+CryptEnumProviderTypesA
+CryptEnumProviderTypesW
+CryptEnumProvidersA
+CryptEnumProvidersW
+CryptExportKey
+CryptGenKey
+CryptGenRandom
+CryptGetDefaultProviderA
+CryptGetDefaultProviderW
+CryptGetHashParam
+CryptGetKeyParam
+CryptGetProvParam
+CryptGetUserKey
+CryptHashData
+CryptHashSessionKey
+CryptImportKey
+CryptReleaseContext
+CryptSetHashParam
+CryptSetKeyParam
+CryptSetProvParam
+CryptSetProviderA
+CryptSetProviderExA
+CryptSetProviderExW
+CryptSetProviderW
+CryptSignHashA
+CryptSignHashW
+CryptVerifySignatureA
+CryptVerifySignatureW
+CveEventWrite
+DecryptFileA
+DecryptFileW
+DeleteAce
+DeleteService
+DeregisterEventSource
+DestroyPrivateObjectSecurity
+DuplicateEncryptionInfoFile
+DuplicateToken
+DuplicateTokenEx
+EncryptFileA
+EncryptFileW
+EncryptionDisable
+EnumDependentServicesA
+EnumDependentServicesW
+EnumDynamicTimeZoneInformation
+EnumServicesStatusA
+EnumServicesStatusExA
+EnumServicesStatusExW
+EnumServicesStatusW
+EqualDomainSid
+EqualPrefixSid
+EqualSid
+EventAccessControl
+EventAccessQuery
+EventAccessRemove
+FileEncryptionStatusA
+FileEncryptionStatusW
+FindFirstFreeAce
+FreeEncryptionCertificateHashList
+FreeInheritedFromArray
+FreeSid
+GetAce
+GetAclInformation
+GetAuditedPermissionsFromAclA
+GetAuditedPermissionsFromAclW
+GetCurrentHwProfileA
+GetCurrentHwProfileW
+GetDynamicTimeZoneInformationEffectiveYears
+GetEffectiveRightsFromAclA
+GetEffectiveRightsFromAclW
+GetEventLogInformation
+GetExplicitEntriesFromAclA
+GetExplicitEntriesFromAclW
+GetFileSecurityA
+GetFileSecurityW
+GetInheritanceSourceA
+GetInheritanceSourceW
+GetKernelObjectSecurity
+GetLengthSid
+GetLocalManagedApplications
+GetManagedApplicationCategories
+GetManagedApplications
+GetNamedSecurityInfoA
+GetNamedSecurityInfoW
+GetNumberOfEventLogRecords
+GetOldestEventLogRecord
+GetPrivateObjectSecurity
+GetSecurityDescriptorControl
+GetSecurityDescriptorDacl
+GetSecurityDescriptorGroup
+GetSecurityDescriptorLength
+GetSecurityDescriptorOwner
+GetSecurityDescriptorRMControl
+GetSecurityDescriptorSacl
+GetSecurityInfo
+GetServiceDisplayNameA
+GetServiceDisplayNameW
+GetServiceKeyNameA
+GetServiceKeyNameW
+GetSidIdentifierAuthority
+GetSidLengthRequired
+GetSidSubAuthority
+GetSidSubAuthorityCount
+GetThreadWaitChain
+GetTokenInformation
+GetTrusteeFormA
+GetTrusteeFormW
+GetTrusteeNameA
+GetTrusteeNameW
+GetTrusteeTypeA
+GetTrusteeTypeW
+GetUserNameA
+GetUserNameW
+GetWindowsAccountDomainSid
+ImpersonateAnonymousToken
+ImpersonateLoggedOnUser
+ImpersonateNamedPipeClient
+ImpersonateSelf
+InitializeAcl
+InitializeSecurityDescriptor
+InitializeSid
+InitiateShutdownA
+InitiateShutdownW
+InitiateSystemShutdownA
+InitiateSystemShutdownExA
+InitiateSystemShutdownExW
+InitiateSystemShutdownW
+InstallApplication
+IsTextUnicode
+IsTokenRestricted
+IsValidAcl
+IsValidSecurityDescriptor
+IsValidSid
+IsWellKnownSid
+LockServiceDatabase
+LogonUserA
+LogonUserExA
+LogonUserExW
+LogonUserW
+LookupAccountNameA
+LookupAccountNameW
+LookupAccountSidA
+LookupAccountSidW
+LookupPrivilegeDisplayNameA
+LookupPrivilegeDisplayNameW
+LookupPrivilegeNameA
+LookupPrivilegeNameW
+LookupPrivilegeValueA
+LookupPrivilegeValueW
+LookupSecurityDescriptorPartsA
+LookupSecurityDescriptorPartsW
+LsaAddAccountRights
+LsaClose
+LsaCreateTrustedDomainEx
+LsaDeleteTrustedDomain
+LsaEnumerateAccountRights
+LsaEnumerateAccountsWithUserRight
+LsaEnumerateTrustedDomains
+LsaEnumerateTrustedDomainsEx
+LsaFreeMemory
+LsaGetAppliedCAPIDs
+LsaLookupNames
+LsaLookupNames2
+LsaLookupPrivilegeValue
+LsaLookupSids
+LsaLookupSids2
+LsaNtStatusToWinError
+LsaOpenPolicy
+LsaOpenTrustedDomainByName
+LsaQueryCAPs
+LsaQueryDomainInformationPolicy
+LsaQueryForestTrustInformation
+LsaQueryInformationPolicy
+LsaQueryTrustedDomainInfo
+LsaQueryTrustedDomainInfoByName
+LsaRemoveAccountRights
+LsaRetrievePrivateData
+LsaSetDomainInformationPolicy
+LsaSetForestTrustInformation
+LsaSetInformationPolicy
+LsaSetTrustedDomainInfoByName
+LsaSetTrustedDomainInformation
+LsaStorePrivateData
+MSChapSrvChangePassword
+MSChapSrvChangePassword2
+MakeAbsoluteSD
+MakeSelfRelativeSD
+MapGenericMask
+NotifyBootConfigStatus
+NotifyChangeEventLog
+NotifyServiceStatusChangeA
+NotifyServiceStatusChangeW
+ObjectCloseAuditAlarmA
+ObjectCloseAuditAlarmW
+ObjectDeleteAuditAlarmA
+ObjectDeleteAuditAlarmW
+ObjectOpenAuditAlarmA
+ObjectOpenAuditAlarmW
+ObjectPrivilegeAuditAlarmA
+ObjectPrivilegeAuditAlarmW
+OpenBackupEventLogA
+OpenBackupEventLogW
+OpenEncryptedFileRawA
+OpenEncryptedFileRawW
+OpenEventLogA
+OpenEventLogW
+OpenProcessToken
+OpenSCManagerA
+OpenSCManagerW
+OpenServiceA
+OpenServiceW
+OpenThreadToken
+OpenThreadWaitChainSession
+OperationEnd
+OperationStart
+PerfAddCounters
+PerfCloseQueryHandle
+PerfCreateInstance
+PerfDecrementULongCounterValue
+PerfDecrementULongLongCounterValue
+PerfDeleteCounters
+PerfDeleteInstance
+PerfEnumerateCounterSet
+PerfEnumerateCounterSetInstances
+PerfIncrementULongCounterValue
+PerfIncrementULongLongCounterValue
+PerfOpenQueryHandle
+PerfQueryCounterData
+PerfQueryCounterInfo
+PerfQueryCounterSetRegistrationInfo
+PerfQueryInstance
+PerfSetCounterRefValue
+PerfSetCounterSetInfo
+PerfSetULongCounterValue
+PerfSetULongLongCounterValue
+PerfStartProvider
+PerfStartProviderEx
+PerfStopProvider
+PrivilegeCheck
+PrivilegedServiceAuditAlarmA
+PrivilegedServiceAuditAlarmW
+QueryRecoveryAgentsOnEncryptedFile
+QuerySecurityAccessMask
+QueryServiceConfig2A
+QueryServiceConfig2W
+QueryServiceConfigA
+QueryServiceConfigW
+QueryServiceDynamicInformation
+QueryServiceLockStatusA
+QueryServiceLockStatusW
+QueryServiceObjectSecurity
+QueryServiceStatus
+QueryServiceStatusEx
+QueryUsersOnEncryptedFile
+ReadEncryptedFileRaw
+ReadEventLogA
+ReadEventLogW
+RegCloseKey
+RegConnectRegistryA
+RegConnectRegistryW
+RegCopyTreeA
+RegCopyTreeW
+RegCreateKeyA
+RegCreateKeyExA
+RegCreateKeyExW
+RegCreateKeyTransactedA
+RegCreateKeyTransactedW
+RegCreateKeyW
+RegDeleteKeyA
+RegDeleteKeyExA
+RegDeleteKeyExW
+RegDeleteKeyTransactedA
+RegDeleteKeyTransactedW
+RegDeleteKeyValueA
+RegDeleteKeyValueW
+RegDeleteKeyW
+RegDeleteTreeA
+RegDeleteTreeW
+RegDeleteValueA
+RegDeleteValueW
+RegDisablePredefinedCache
+RegDisablePredefinedCacheEx
+RegDisableReflectionKey
+RegEnableReflectionKey
+RegEnumKeyA
+RegEnumKeyExA
+RegEnumKeyExW
+RegEnumKeyW
+RegEnumValueA
+RegEnumValueW
+RegFlushKey
+RegGetKeySecurity
+RegGetValueA
+RegGetValueW
+RegLoadAppKeyA
+RegLoadAppKeyW
+RegLoadKeyA
+RegLoadKeyW
+RegLoadMUIStringA
+RegLoadMUIStringW
+RegNotifyChangeKeyValue
+RegOpenCurrentUser
+RegOpenKeyA
+RegOpenKeyExA
+RegOpenKeyExW
+RegOpenKeyTransactedA
+RegOpenKeyTransactedW
+RegOpenKeyW
+RegOpenUserClassesRoot
+RegOverridePredefKey
+RegQueryInfoKeyA
+RegQueryInfoKeyW
+RegQueryMultipleValuesA
+RegQueryMultipleValuesW
+RegQueryReflectionKey
+RegQueryValueA
+RegQueryValueExA
+RegQueryValueExW
+RegQueryValueW
+RegReplaceKeyA
+RegReplaceKeyW
+RegRestoreKeyA
+RegRestoreKeyW
+RegSaveKeyA
+RegSaveKeyExA
+RegSaveKeyExW
+RegSaveKeyW
+RegSetKeySecurity
+RegSetKeyValueA
+RegSetKeyValueW
+RegSetValueA
+RegSetValueExA
+RegSetValueExW
+RegSetValueW
+RegUnLoadKeyA
+RegUnLoadKeyW
+RegisterEventSourceA
+RegisterEventSourceW
+RegisterServiceCtrlHandlerA
+RegisterServiceCtrlHandlerExA
+RegisterServiceCtrlHandlerExW
+RegisterServiceCtrlHandlerW
+RegisterWaitChainCOMCallback
+RemoveUsersFromEncryptedFile
+ReportEventA
+ReportEventW
+RevertToSelf
+RtlDecryptMemory
+RtlEncryptMemory
+RtlGenRandom
+SaferCloseLevel
+SaferComputeTokenFromLevel
+SaferCreateLevel
+SaferGetLevelInformation
+SaferGetPolicyInformation
+SaferIdentifyLevel
+SaferRecordEventLogEntry
+SaferSetLevelInformation
+SaferSetPolicyInformation
+SaferiIsExecutableFileType
+SetAclInformation
+SetEntriesInAclA
+SetEntriesInAclW
+SetFileSecurityA
+SetFileSecurityW
+SetKernelObjectSecurity
+SetNamedSecurityInfoA
+SetNamedSecurityInfoW
+SetPrivateObjectSecurity
+SetPrivateObjectSecurityEx
+SetSecurityAccessMask
+SetSecurityDescriptorControl
+SetSecurityDescriptorDacl
+SetSecurityDescriptorGroup
+SetSecurityDescriptorOwner
+SetSecurityDescriptorRMControl
+SetSecurityDescriptorSacl
+SetSecurityInfo
+SetServiceBits
+SetServiceObjectSecurity
+SetServiceStatus
+SetThreadToken
+SetTokenInformation
+SetUserFileEncryptionKey
+StartServiceA
+StartServiceCtrlDispatcherA
+StartServiceCtrlDispatcherW
+StartServiceW
+TreeResetNamedSecurityInfoA
+TreeResetNamedSecurityInfoW
+TreeSetNamedSecurityInfoA
+TreeSetNamedSecurityInfoW
+UninstallApplication
+UnlockServiceDatabase
+WriteEncryptedFileRaw
diff --git a/crates/exav-pe-emu/src/exports/kernel32.txt b/crates/exav-pe-emu/src/exports/kernel32.txt
new file mode 100644
index 0000000..4c5c232
--- /dev/null
+++ b/crates/exav-pe-emu/src/exports/kernel32.txt
@@ -0,0 +1,1267 @@
+AcquireSRWLockExclusive
+AcquireSRWLockShared
+ActivateActCtx
+AddAtomA
+AddAtomW
+AddDllDirectory
+AddIntegrityLabelToBoundaryDescriptor
+AddRefActCtx
+AddResourceAttributeAce
+AddSIDToBoundaryDescriptor
+AddScopedPolicyIDAce
+AddSecureMemoryCacheCallback
+AddVectoredContinueHandler
+AddVectoredExceptionHandler
+AllocateUserPhysicalPages
+AllocateUserPhysicalPagesNuma
+AppPolicyGetCreateFileAccess
+AppPolicyGetProcessTerminationMethod
+AppPolicyGetShowDeveloperDiagnostic
+AppPolicyGetThreadInitializationType
+AppPolicyGetWindowingModel
+ApplicationRecoveryFinished
+ApplicationRecoveryInProgress
+AreFileApisANSI
+AssignProcessToJobObject
+BackupRead
+BackupSeek
+BackupWrite
+Beep
+BeginUpdateResourceA
+BeginUpdateResourceW
+BindIoCompletionCallback
+BuildCommDCBA
+BuildCommDCBAndTimeoutsA
+BuildCommDCBAndTimeoutsW
+BuildCommDCBW
+CallEnclave
+CallNamedPipeA
+CallNamedPipeW
+CallbackMayRunLong
+CancelIo
+CancelIoEx
+CancelSynchronousIo
+CancelThreadpoolIo
+CancelWaitableTimer
+CeipIsOptedIn
+ChangeTimerQueueTimer
+CheckNameLegalDOS8Dot3A
+CheckNameLegalDOS8Dot3W
+CheckRemoteDebuggerPresent
+CheckTokenCapability
+CheckTokenMembershipEx
+ClearCommBreak
+ClearCommError
+CloseHandle
+ClosePackageInfo
+ClosePrivateNamespace
+CloseThreadpool
+CloseThreadpoolCleanupGroup
+CloseThreadpoolCleanupGroupMembers
+CloseThreadpoolIo
+CloseThreadpoolTimer
+CloseThreadpoolWait
+CloseThreadpoolWork
+CommConfigDialogA
+CommConfigDialogW
+CompareFileTime
+CompareObjectHandles
+CompareString
+CompareStringA
+CompareStringEx
+CompareStringOrdinal
+CompareStringW
+ConnectNamedPipe
+ContinueDebugEvent
+ConvertAuxiliaryCounterToPerformanceCounter
+ConvertDefaultLocale
+ConvertFiberToThread
+ConvertPerformanceCounterToAuxiliaryCounter
+ConvertThreadToFiber
+ConvertThreadToFiberEx
+CopyContext
+CopyFile
+CopyFile2
+CopyFileA
+CopyFileExA
+CopyFileExW
+CopyFileTransactedA
+CopyFileTransactedW
+CopyFileW
+CreateActCtxA
+CreateActCtxW
+CreateBoundaryDescriptorA
+CreateBoundaryDescriptorW
+CreateDirectory
+CreateDirectoryA
+CreateDirectoryExA
+CreateDirectoryExW
+CreateDirectoryTransactedA
+CreateDirectoryTransactedW
+CreateDirectoryW
+CreateEnclave
+CreateEventA
+CreateEventExA
+CreateEventExW
+CreateEventW
+CreateFiber
+CreateFiberEx
+CreateFile2
+CreateFileA
+CreateFileMapping2
+CreateFileMappingA
+CreateFileMappingFromApp
+CreateFileMappingNumaA
+CreateFileMappingNumaW
+CreateFileMappingW
+CreateFileTransactedA
+CreateFileTransactedW
+CreateFileW
+CreateHardLinkA
+CreateHardLinkTransactedA
+CreateHardLinkTransactedW
+CreateHardLinkW
+CreateIoCompletionPort
+CreateJobObjectA
+CreateJobObjectW
+CreateMailslotA
+CreateMailslotW
+CreateMemoryResourceNotification
+CreateMutexA
+CreateMutexExA
+CreateMutexExW
+CreateMutexW
+CreateNamedPipeA
+CreateNamedPipeW
+CreatePipe
+CreatePrivateNamespaceA
+CreatePrivateNamespaceW
+CreateProcessA
+CreateProcessAsUserA
+CreateProcessAsUserW
+CreateProcessW
+CreateRemoteThread
+CreateRemoteThreadEx
+CreateSemaphoreA
+CreateSemaphoreExA
+CreateSemaphoreExW
+CreateSemaphoreW
+CreateSymbolicLinkA
+CreateSymbolicLinkTransactedA
+CreateSymbolicLinkTransactedW
+CreateSymbolicLinkW
+CreateTapePartition
+CreateThread
+CreateThreadpool
+CreateThreadpoolCleanupGroup
+CreateThreadpoolIo
+CreateThreadpoolTimer
+CreateThreadpoolWait
+CreateThreadpoolWork
+CreateTimerQueue
+CreateTimerQueueTimer
+CreateToolhelp32Snapshot
+CreateUmsCompletionList
+CreateUmsThreadContext
+CreateWaitableTimerExW
+CreateWaitableTimerW
+DeactivateActCtx
+DebugActiveProcess
+DebugActiveProcessStop
+DebugBreak
+DebugBreakProcess
+DebugSetProcessKillOnExit
+DefineDosDeviceA
+DefineDosDeviceW
+DeleteAtom
+DeleteBoundaryDescriptor
+DeleteCriticalSection
+DeleteEnclave
+DeleteFiber
+DeleteFile
+DeleteFileA
+DeleteFileTransactedA
+DeleteFileTransactedW
+DeleteFileW
+DeleteProcThreadAttributeList
+DeleteSynchronizationBarrier
+DeleteTimerQueue
+DeleteTimerQueueEx
+DeleteTimerQueueTimer
+DeleteUmsCompletionList
+DeleteUmsThreadContext
+DeleteVolumeMountPointA
+DeleteVolumeMountPointW
+DequeueUmsCompletionListItems
+DeviceIoControl
+DisableThreadLibraryCalls
+DisableThreadProfiling
+DisassociateCurrentThreadFromCallback
+DiscardVirtualMemory
+DisconnectNamedPipe
+DnsHostnameToComputerNameA
+DnsHostnameToComputerNameW
+DosDateTimeToFileTime
+DuplicateHandle
+EmptyWorkingSet
+EnableThreadProfiling
+EndUpdateResourceA
+EndUpdateResourceW
+EnterCriticalSection
+EnterSynchronizationBarrier
+EnterUmsSchedulingMode
+EnumCalendarInfoA
+EnumCalendarInfoExA
+EnumCalendarInfoExEx
+EnumCalendarInfoExW
+EnumCalendarInfoW
+EnumDateFormatsA
+EnumDateFormatsExA
+EnumDateFormatsExEx
+EnumDateFormatsExW
+EnumDateFormatsW
+EnumDeviceDrivers
+EnumDynamicTimeZoneInformation
+EnumLanguageGroupLocalesA
+EnumLanguageGroupLocalesW
+EnumPageFilesA
+EnumPageFilesW
+EnumProcessModules
+EnumProcessModulesEx
+EnumProcesses
+EnumResourceLanguagesA
+EnumResourceLanguagesExA
+EnumResourceLanguagesExW
+EnumResourceLanguagesW
+EnumResourceNamesA
+EnumResourceNamesExA
+EnumResourceNamesExW
+EnumResourceNamesW
+EnumResourceTypesA
+EnumResourceTypesExA
+EnumResourceTypesExW
+EnumResourceTypesW
+EnumSystemCodePagesA
+EnumSystemCodePagesW
+EnumSystemFirmwareTables
+EnumSystemGeoID
+EnumSystemGeoNames
+EnumSystemLanguageGroupsA
+EnumSystemLanguageGroupsW
+EnumSystemLocalesA
+EnumSystemLocalesEx
+EnumSystemLocalesW
+EnumTimeFormatsA
+EnumTimeFormatsEx
+EnumTimeFormatsW
+EnumUILanguagesA
+EnumUILanguagesW
+EraseTape
+EscapeCommFunction
+ExecuteUmsThread
+ExitProcess
+ExitThread
+ExpandEnvironmentStringsA
+ExpandEnvironmentStringsW
+FatalAppExitA
+FatalAppExitW
+FatalExit
+FileTimeToDosDateTime
+FileTimeToLocalFileTime
+FileTimeToSystemTime
+FindActCtxSectionGuid
+FindActCtxSectionStringA
+FindActCtxSectionStringW
+FindAtomA
+FindAtomW
+FindClose
+FindCloseChangeNotification
+FindFirstChangeNotificationA
+FindFirstChangeNotificationW
+FindFirstFileA
+FindFirstFileExA
+FindFirstFileExW
+FindFirstFileNameTransactedW
+FindFirstFileNameW
+FindFirstFileTransactedA
+FindFirstFileTransactedW
+FindFirstFileW
+FindFirstStreamTransactedW
+FindFirstStreamW
+FindFirstVolumeA
+FindFirstVolumeMountPointA
+FindFirstVolumeMountPointW
+FindFirstVolumeW
+FindNLSString
+FindNLSStringEx
+FindNextChangeNotification
+FindNextFileA
+FindNextFileNameW
+FindNextFileW
+FindNextStreamW
+FindNextVolumeA
+FindNextVolumeMountPointA
+FindNextVolumeMountPointW
+FindNextVolumeW
+FindPackagesByPackageFamily
+FindResourceA
+FindResourceExA
+FindResourceExW
+FindResourceW
+FindStringOrdinal
+FindVolumeClose
+FindVolumeMountPointClose
+FlsAlloc
+FlsFree
+FlsGetValue
+FlsSetValue
+FlushFileBuffers
+FlushInstructionCache
+FlushProcessWriteBuffers
+FlushViewOfFile
+FoldStringA
+FoldStringW
+FormatApplicationUserModelId
+FormatMessage
+FormatMessageA
+FormatMessageW
+FreeEnvironmentStringsA
+FreeEnvironmentStringsW
+FreeLibrary
+FreeLibraryAndExitThread
+FreeLibraryWhenCallbackReturns
+FreeMemoryJobObject
+FreeResource
+FreeUserPhysicalPages
+GetACP
+GetActiveProcessorCount
+GetActiveProcessorGroupCount
+GetAppContainerNamedObjectPath
+GetApplicationRecoveryCallback
+GetApplicationRestartSettings
+GetApplicationUserModelId
+GetApplicationUserModelIdFromToken
+GetAtomNameA
+GetAtomNameW
+GetBinaryTypeA
+GetBinaryTypeW
+GetCPInfo
+GetCPInfoExA
+GetCPInfoExW
+GetCalendarInfoA
+GetCalendarInfoEx
+GetCalendarInfoW
+GetCommConfig
+GetCommMask
+GetCommModemStatus
+GetCommProperties
+GetCommState
+GetCommTimeouts
+GetCommandLineA
+GetCommandLineW
+GetCompressedFileSizeA
+GetCompressedFileSizeTransactedA
+GetCompressedFileSizeTransactedW
+GetCompressedFileSizeW
+GetComputerNameA
+GetComputerNameExA
+GetComputerNameExW
+GetComputerNameW
+GetCurrencyFormatA
+GetCurrencyFormatEx
+GetCurrencyFormatW
+GetCurrentActCtx
+GetCurrentApplicationUserModelId
+GetCurrentDirectory
+GetCurrentPackageFamilyName
+GetCurrentPackageFullName
+GetCurrentPackageId
+GetCurrentPackageInfo
+GetCurrentPackagePath
+GetCurrentProcess
+GetCurrentProcessId
+GetCurrentProcessorNumber
+GetCurrentProcessorNumberEx
+GetCurrentThread
+GetCurrentThreadId
+GetCurrentThreadStackLimits
+GetCurrentUmsThread
+GetDateFormatA
+GetDateFormatEx
+GetDateFormatW
+GetDefaultCommConfigA
+GetDefaultCommConfigW
+GetDeviceDriverBaseNameA
+GetDeviceDriverBaseNameW
+GetDeviceDriverFileNameA
+GetDeviceDriverFileNameW
+GetDevicePowerState
+GetDiskFreeSpaceA
+GetDiskFreeSpaceExA
+GetDiskFreeSpaceExW
+GetDiskFreeSpaceW
+GetDiskSpaceInformationA
+GetDiskSpaceInformationW
+GetDllDirectoryA
+GetDllDirectoryW
+GetDriveTypeA
+GetDriveTypeW
+GetDurationFormat
+GetDurationFormatEx
+GetDynamicTimeZoneInformation
+GetDynamicTimeZoneInformationEffectiveYears
+GetEnabledXStateFeatures
+GetEnvironmentStrings
+GetEnvironmentStringsW
+GetEnvironmentVariable
+GetEnvironmentVariableA
+GetEnvironmentVariableW
+GetErrorMode
+GetExitCodeProcess
+GetExitCodeThread
+GetFileAttributesA
+GetFileAttributesExA
+GetFileAttributesExW
+GetFileAttributesTransactedA
+GetFileAttributesTransactedW
+GetFileAttributesW
+GetFileBandwidthReservation
+GetFileInformationByHandle
+GetFileInformationByHandleEx
+GetFileMUIInfo
+GetFileMUIPath
+GetFileSize
+GetFileSizeEx
+GetFileTime
+GetFileType
+GetFinalPathNameByHandleA
+GetFinalPathNameByHandleW
+GetFirmwareEnvironmentVariableA
+GetFirmwareEnvironmentVariableExA
+GetFirmwareEnvironmentVariableExW
+GetFirmwareEnvironmentVariableW
+GetFirmwareType
+GetFullPathNameA
+GetFullPathNameTransactedA
+GetFullPathNameTransactedW
+GetFullPathNameW
+GetGeoInfoA
+GetGeoInfoEx
+GetGeoInfoW
+GetHandleInformation
+GetLargePageMinimum
+GetLastError
+GetLocalTime
+GetLocaleInfoA
+GetLocaleInfoEx
+GetLocaleInfoW
+GetLogicalDriveStringsA
+GetLogicalDriveStringsW
+GetLogicalDrives
+GetLogicalProcessorInformation
+GetLogicalProcessorInformationEx
+GetLongPathNameA
+GetLongPathNameTransactedA
+GetLongPathNameTransactedW
+GetLongPathNameW
+GetMachineTypeAttributes
+GetMailslotInfo
+GetMappedFileNameA
+GetMappedFileNameW
+GetMaximumProcessorCount
+GetMaximumProcessorGroupCount
+GetMemoryErrorHandlingCapabilities
+GetModuleBaseNameA
+GetModuleBaseNameW
+GetModuleFileNameA
+GetModuleFileNameExA
+GetModuleFileNameExW
+GetModuleFileNameW
+GetModuleHandleA
+GetModuleHandleExA
+GetModuleHandleExW
+GetModuleHandleW
+GetModuleInformation
+GetNLSVersion
+GetNLSVersionEx
+GetNamedPipeClientComputerNameA
+GetNamedPipeClientComputerNameW
+GetNamedPipeClientProcessId
+GetNamedPipeClientSessionId
+GetNamedPipeHandleStateA
+GetNamedPipeHandleStateW
+GetNamedPipeInfo
+GetNamedPipeServerProcessId
+GetNamedPipeServerSessionId
+GetNativeSystemInfo
+GetNextUmsListItem
+GetNumaAvailableMemoryNode
+GetNumaAvailableMemoryNodeEx
+GetNumaHighestNodeNumber
+GetNumaNodeNumberFromHandle
+GetNumaNodeProcessorMask
+GetNumaNodeProcessorMaskEx
+GetNumaProcessorNode
+GetNumaProcessorNodeEx
+GetNumaProximityNode
+GetNumaProximityNodeEx
+GetNumberFormatA
+GetNumberFormatEx
+GetNumberFormatW
+GetOEMCP
+GetOverlappedResult
+GetOverlappedResultEx
+GetPackageApplicationIds
+GetPackageFamilyName
+GetPackageFamilyNameFromToken
+GetPackageFullName
+GetPackageFullNameFromToken
+GetPackageId
+GetPackageInfo
+GetPackagePath
+GetPackagePathByFullName
+GetPackagesByPackageFamily
+GetPerformanceInfo
+GetPhysicallyInstalledSystemMemory
+GetPriorityClass
+GetPrivateProfileInt
+GetPrivateProfileIntA
+GetPrivateProfileIntW
+GetPrivateProfileSection
+GetPrivateProfileSectionA
+GetPrivateProfileSectionNames
+GetPrivateProfileSectionNamesA
+GetPrivateProfileSectionNamesW
+GetPrivateProfileSectionW
+GetPrivateProfileString
+GetPrivateProfileStringA
+GetPrivateProfileStringW
+GetPrivateProfileStruct
+GetPrivateProfileStructA
+GetPrivateProfileStructW
+GetProcAddress
+GetProcessAffinityMask
+GetProcessDEPPolicy
+GetProcessDefaultCpuSetMasks
+GetProcessGroupAffinity
+GetProcessHandleCount
+GetProcessHeap
+GetProcessHeaps
+GetProcessId
+GetProcessIdOfThread
+GetProcessImageFileNameA
+GetProcessImageFileNameW
+GetProcessInformation
+GetProcessIoCounters
+GetProcessMemoryInfo
+GetProcessMitigationPolicy
+GetProcessPreferredUILanguages
+GetProcessPriorityBoost
+GetProcessShutdownParameters
+GetProcessTimes
+GetProcessVersion
+GetProcessWorkingSetSize
+GetProcessWorkingSetSizeEx
+GetProcessorSystemCycleTime
+GetProductInfo
+GetProfileIntA
+GetProfileIntW
+GetProfileSectionA
+GetProfileSectionW
+GetProfileStringA
+GetProfileStringW
+GetQueuedCompletionStatus
+GetQueuedCompletionStatusEx
+GetShortPathNameA
+GetShortPathNameW
+GetStagedPackageOrigin
+GetStagedPackagePathByFullName
+GetStartupInfoW
+GetStringScripts
+GetStringTypeA
+GetStringTypeExW
+GetStringTypeW
+GetSystemDEPPolicy
+GetSystemDefaultLCID
+GetSystemDefaultLangID
+GetSystemDefaultLocaleName
+GetSystemDefaultUILanguage
+GetSystemDirectoryA
+GetSystemDirectoryW
+GetSystemFileCacheSize
+GetSystemFirmwareTable
+GetSystemInfo
+GetSystemPowerStatus
+GetSystemPreferredUILanguages
+GetSystemRegistryQuota
+GetSystemTime
+GetSystemTimeAdjustment
+GetSystemTimeAsFileTime
+GetSystemTimePreciseAsFileTime
+GetSystemTimes
+GetSystemWindowsDirectoryA
+GetSystemWindowsDirectoryW
+GetSystemWow64Directory2A
+GetSystemWow64Directory2W
+GetSystemWow64DirectoryA
+GetSystemWow64DirectoryW
+GetTapeParameters
+GetTapePosition
+GetTapeStatus
+GetTempFileName
+GetTempFileNameA
+GetTempFileNameW
+GetTempPath2A
+GetTempPath2W
+GetTempPathA
+GetTempPathW
+GetThreadContext
+GetThreadDescription
+GetThreadErrorMode
+GetThreadGroupAffinity
+GetThreadIOPendingFlag
+GetThreadId
+GetThreadIdealProcessorEx
+GetThreadInformation
+GetThreadLocale
+GetThreadPreferredUILanguages
+GetThreadPriority
+GetThreadPriorityBoost
+GetThreadSelectedCpuSetMasks
+GetThreadSelectorEntry
+GetThreadTimes
+GetThreadUILanguage
+GetTickCount
+GetTickCount64
+GetTimeFormatA
+GetTimeFormatEx
+GetTimeFormatW
+GetTimeZoneInformation
+GetTimeZoneInformationForYear
+GetUILanguageInfo
+GetUmsCompletionListEvent
+GetUmsSystemThreadInformation
+GetUserDefaultGeoName
+GetUserDefaultLCID
+GetUserDefaultLangID
+GetUserDefaultLocaleName
+GetUserDefaultUILanguage
+GetUserGeoID
+GetUserPreferredUILanguages
+GetVersion
+GetVersionExA
+GetVersionExW
+GetVolumeInformationA
+GetVolumeInformationByHandleW
+GetVolumeInformationW
+GetVolumeNameForVolumeMountPointA
+GetVolumeNameForVolumeMountPointW
+GetVolumePathNameA
+GetVolumePathNameW
+GetVolumePathNamesForVolumeNameA
+GetVolumePathNamesForVolumeNameW
+GetWindowsDirectoryA
+GetWindowsDirectoryW
+GetWriteWatch
+GetWsChanges
+GetWsChangesEx
+GetXStateFeaturesMask
+GlobalAddAtomA
+GlobalAddAtomExA
+GlobalAddAtomExW
+GlobalAddAtomW
+GlobalAlloc
+GlobalDeleteAtom
+GlobalFindAtomA
+GlobalFindAtomW
+GlobalFlags
+GlobalFree
+GlobalGetAtomNameA
+GlobalGetAtomNameW
+GlobalHandle
+GlobalLock
+GlobalMemoryStatus
+GlobalMemoryStatusEx
+GlobalReAlloc
+GlobalSize
+GlobalUnlock
+Heap32First
+Heap32ListFirst
+Heap32ListNext
+Heap32Next
+HeapAlloc
+HeapCompact
+HeapCreate
+HeapDestroy
+HeapFree
+HeapLock
+HeapQueryInformation
+HeapReAlloc
+HeapSetInformation
+HeapSize
+HeapSummary
+HeapUnlock
+HeapValidate
+HeapWalk
+IdnToAscii
+ImpersonateNamedPipeClient
+InitAtomTable
+InitOnceBeginInitialize
+InitOnceComplete
+InitOnceExecuteOnce
+InitOnceInitialize
+InitSecurityInterfaceA
+InitSecurityInterfaceW
+InitializeConditionVariable
+InitializeContext
+InitializeCriticalSection
+InitializeCriticalSectionAndSpinCount
+InitializeCriticalSectionEx
+InitializeEnclave
+InitializeProcThreadAttributeList
+InitializeProcessForWsWatch
+InitializeSListHead
+InitializeSRWLock
+InitializeSynchronizationBarrier
+InstallELAMCertificateInfo
+InterlockedCompareExchange
+InterlockedCompareExchange64
+InterlockedDecrement
+InterlockedExchange
+InterlockedExchangeAdd
+InterlockedFlushSList
+InterlockedIncrement
+InterlockedPopEntrySList
+InterlockedPushEntrySList
+InterlockedPushListSListEx
+IsBadCodePtr
+IsBadReadPtr
+IsBadStringPtrA
+IsBadStringPtrW
+IsBadWritePtr
+IsDBCSLeadByte
+IsDBCSLeadByteEx
+IsDebuggerPresent
+IsEnclaveTypeSupported
+IsNLSDefinedString
+IsNativeVhdBoot
+IsProcessCritical
+IsProcessInJob
+IsProcessorFeaturePresent
+IsSystemResumeAutomatic
+IsThreadAFiber
+IsThreadpoolTimerSet
+IsValidCodePage
+IsValidLanguageGroup
+IsValidLocale
+IsValidLocaleName
+IsValidNLSVersion
+IsWow64GuestMachineSupported
+IsWow64Process
+IsWow64Process2
+LCIDToLocaleName
+LCMapStringA
+LCMapStringEx
+LCMapStringW
+LeaveCriticalSection
+LeaveCriticalSectionWhenCallbackReturns
+LoadEnclaveData
+LoadEnclaveImageA
+LoadEnclaveImageW
+LoadLibraryA
+LoadLibraryExA
+LoadLibraryExW
+LoadLibraryW
+LoadModule
+LoadPackagedLibrary
+LoadResource
+LoadStringA
+LoadStringByReference
+LoadStringW
+LocalAlloc
+LocalFileTimeToFileTime
+LocalFlags
+LocalFree
+LocalHandle
+LocalLock
+LocalReAlloc
+LocalSize
+LocalUnlock
+LocaleNameToLCID
+LocateXStateFeature
+LockFile
+LockFileEx
+LockResource
+MapUserPhysicalPages
+MapUserPhysicalPagesScatter
+MapViewOfFile
+MapViewOfFile2
+MapViewOfFile3
+MapViewOfFile3FromApp
+MapViewOfFileEx
+MapViewOfFileExNuma
+MapViewOfFileFromApp
+Module32First
+Module32FirstW
+Module32Next
+Module32NextW
+MoveFile
+MoveFileA
+MoveFileExA
+MoveFileExW
+MoveFileTransactedA
+MoveFileTransactedW
+MoveFileW
+MoveFileWithProgressA
+MoveFileWithProgressW
+MulDiv
+MultiByteToWideChar
+NdisAllocateBuffer
+NdisAllocateBufferPool
+NdisAllocatePacketPoolEx
+NdisCancelSendPackets
+NdisCloseAdapter
+NdisCopyFromPacketToPacketSafe
+NdisDeregisterProtocol
+NdisFreePacketPool
+NdisGetReceivedPacket
+NdisIMCopySendCompletePerPacketInfo
+NdisIMCopySendPerPacketInfo
+NdisIMDeregisterLayeredMiniport
+NdisIMGetDeviceContext
+NdisIMNotifyPnPEvent
+NdisIMRegisterLayeredMiniport
+NdisMDeregisterDevice
+NdisMIndicateStatus
+NdisMInitializeWrapper
+NdisMRegisterDevice
+NdisMRegisterUnloadHandler
+NdisMSetAttributesEx
+NdisOpenAdapter
+NdisOpenProtocolConfiguration
+NdisPacketPoolUsage
+NdisRegisterProtocol
+NdisRequest
+NdisScheduleWorkItem
+NdisTerminateWrapper
+NdisUnchainBufferAtBack
+NeedCurrentDirectoryForExePathA
+NeedCurrentDirectoryForExePathW
+NotifyUILanguageChange
+OfferVirtualMemory
+OpenEventA
+OpenEventW
+OpenFile
+OpenFileById
+OpenFileMappingA
+OpenFileMappingFromApp
+OpenFileMappingW
+OpenJobObjectA
+OpenJobObjectW
+OpenMutexW
+OpenPackageInfoByFullName
+OpenPrivateNamespaceA
+OpenPrivateNamespaceW
+OpenProcess
+OpenProcessToken
+OpenSemaphoreW
+OpenThread
+OpenThreadToken
+OpenWaitableTimerW
+OutputDebugStringA
+OutputDebugStringW
+PackageFamilyNameFromFullName
+PackageFamilyNameFromId
+PackageFullNameFromId
+PackageIdFromFullName
+PackageNameAndPublisherIdFromFamilyName
+ParseApplicationUserModelId
+PeekNamedPipe
+PostQueuedCompletionStatus
+PowerClearRequest
+PowerCreateRequest
+PowerSetRequest
+PrefetchVirtualMemory
+PrepareTape
+Process32First
+Process32FirstW
+Process32Next
+Process32NextW
+ProcessIdToSessionId
+PssCaptureSnapshot
+PssDuplicateSnapshot
+PssFreeSnapshot
+PssQuerySnapshot
+PssWalkMarkerCreate
+PssWalkMarkerFree
+PssWalkMarkerGetPosition
+PssWalkMarkerSeekToBeginning
+PssWalkMarkerSetPosition
+PssWalkSnapshot
+PulseEvent
+PurgeComm
+QueryActCtxSettingsW
+QueryActCtxW
+QueryAuxiliaryCounterFrequency
+QueryDepthSList
+QueryDosDeviceA
+QueryDosDeviceW
+QueryFullProcessImageNameA
+QueryFullProcessImageNameW
+QueryIdleProcessorCycleTime
+QueryIdleProcessorCycleTimeEx
+QueryInformationJobObject
+QueryInterruptTime
+QueryInterruptTimePrecise
+QueryIoRateControlInformationJobObject
+QueryMemoryResourceNotification
+QueryPerformanceCounter
+QueryPerformanceFrequency
+QueryProcessAffinityUpdateMode
+QueryProcessCycleTime
+QueryProtectedPolicy
+QueryThreadCycleTime
+QueryThreadProfiling
+QueryThreadpoolStackInformation
+QueryUmsThreadInformation
+QueryUnbiasedInterruptTime
+QueryUnbiasedInterruptTimePrecise
+QueryWorkingSet
+QueryWorkingSetEx
+QueueUserAPC
+QueueUserWorkItem
+RaiseException
+RaiseFailFastException
+ReOpenFile
+ReadDirectoryChangesExW
+ReadDirectoryChangesW
+ReadFile
+ReadFileEx
+ReadFileScatter
+ReadProcessMemory
+ReadThreadProfilingData
+ReclaimVirtualMemory
+RegCloseKey
+RegDeleteKeyA
+RegDeleteKeyExA
+RegDeleteKeyExW
+RegDeleteKeyValueA
+RegDeleteTreeA
+RegDeleteTreeW
+RegEnumKeyExA
+RegEnumValueA
+RegNotifyChangeKeyValue
+RegOpenKeyExA
+RegQueryInfoKeyA
+RegQueryValueExA
+RegQueryValueExW
+RegisterApplicationRecoveryCallback
+RegisterApplicationRestart
+RegisterBadMemoryNotification
+RegisterWaitForSingleObject
+RegisterWaitUntilOOBECompleted
+ReleaseActCtx
+ReleaseMutex
+ReleaseMutexWhenCallbackReturns
+ReleaseSRWLockExclusive
+ReleaseSRWLockShared
+ReleaseSemaphore
+ReleaseSemaphoreWhenCallbackReturns
+RemoveDirectoryA
+RemoveDirectoryTransactedA
+RemoveDirectoryTransactedW
+RemoveDirectoryW
+RemoveDllDirectory
+RemoveSecureMemoryCacheCallback
+RemoveVectoredContinueHandler
+RemoveVectoredExceptionHandler
+ReplaceFileA
+ReplaceFileW
+RequestWakeupLatency
+ResetEvent
+ResetWriteWatch
+ResolveLocaleName
+RestoreLastError
+ResumeThread
+RtlAddFunctionTable
+RtlCaptureContext
+RtlCompareMemory
+RtlDeleteFunctionTable
+RtlFillMemory
+RtlInstallFunctionTableCallback
+RtlLookupFunctionEntry
+RtlPcToFileHeader
+RtlRestoreContext
+RtlUnwind
+RtlUnwind2
+RtlUnwindEx
+RtlVirtualUnwind
+SearchPathA
+SearchPathW
+SetCalendarInfoA
+SetCalendarInfoW
+SetCommBreak
+SetCommConfig
+SetCommMask
+SetCommState
+SetCommTimeouts
+SetComputerNameA
+SetComputerNameExA
+SetComputerNameExW
+SetComputerNameW
+SetCriticalSectionSpinCount
+SetCurrentDirectory
+SetDefaultCommConfigA
+SetDefaultCommConfigW
+SetDefaultDllDirectories
+SetDllDirectoryA
+SetDllDirectoryW
+SetDynamicTimeZoneInformation
+SetEndOfFile
+SetEnvironmentStringsA
+SetEnvironmentStringsW
+SetEnvironmentVariable
+SetEnvironmentVariableA
+SetEnvironmentVariableW
+SetErrorMode
+SetEvent
+SetEventWhenCallbackReturns
+SetFileApisToANSI
+SetFileApisToOEM
+SetFileAttributesA
+SetFileAttributesTransactedA
+SetFileAttributesTransactedW
+SetFileAttributesW
+SetFileBandwidthReservation
+SetFileCompletionNotificationModes
+SetFileInformationByHandle
+SetFileIoOverlappedRange
+SetFilePointer
+SetFilePointerEx
+SetFileShortNameA
+SetFileShortNameW
+SetFileTime
+SetFileValidData
+SetFirmwareEnvironmentVariableA
+SetFirmwareEnvironmentVariableExA
+SetFirmwareEnvironmentVariableExW
+SetFirmwareEnvironmentVariableW
+SetHandleCount
+SetHandleInformation
+SetInformationJobObject
+SetIoRateControlInformationJobObject
+SetLastError
+SetLocalTime
+SetLocaleInfoA
+SetLocaleInfoW
+SetMailslotInfo
+SetNamedPipeHandleState
+SetPriorityClass
+SetProcessAffinityMask
+SetProcessAffinityUpdateMode
+SetProcessDEPPolicy
+SetProcessDefaultCpuSetMasks
+SetProcessInformation
+SetProcessMitigationPolicy
+SetProcessPreferredUILanguages
+SetProcessPriorityBoost
+SetProcessShutdownParameters
+SetProcessWorkingSetSize
+SetProcessWorkingSetSizeEx
+SetProtectedPolicy
+SetSearchPathMode
+SetStdHandleEx
+SetSystemFileCacheSize
+SetSystemPowerState
+SetSystemTime
+SetSystemTimeAdjustment
+SetTapeParameters
+SetTapePosition
+SetThreadAffinityMask
+SetThreadContext
+SetThreadDescription
+SetThreadErrorMode
+SetThreadExecutionState
+SetThreadGroupAffinity
+SetThreadIdealProcessor
+SetThreadIdealProcessorEx
+SetThreadInformation
+SetThreadLocale
+SetThreadPreferredUILanguages
+SetThreadPriority
+SetThreadPriorityBoost
+SetThreadSelectedCpuSetMasks
+SetThreadSelectedCpuSets
+SetThreadStackGuarantee
+SetThreadToken
+SetThreadUILanguage
+SetThreadpoolStackInformation
+SetThreadpoolThreadMaximum
+SetThreadpoolThreadMinimum
+SetThreadpoolTimer
+SetThreadpoolTimerEx
+SetThreadpoolWait
+SetThreadpoolWaitEx
+SetTimeZoneInformation
+SetUmsThreadInformation
+SetUnhandledExceptionFilter
+SetUserGeoID
+SetUserGeoName
+SetVolumeLabelA
+SetVolumeLabelW
+SetVolumeMountPointA
+SetVolumeMountPointW
+SetWaitableTimer
+SetWaitableTimerEx
+SetXStateFeaturesMask
+SetupComm
+SignalObjectAndWait
+SizeofResource
+Sleep
+SleepConditionVariableCS
+SleepConditionVariableSRW
+SleepEx
+StartThreadpoolIo
+SubmitThreadpoolWork
+SuspendThread
+SwitchToFiber
+SwitchToThread
+SystemTimeToFileTime
+SystemTimeToTzSpecificLocalTime
+SystemTimeToTzSpecificLocalTimeEx
+TerminateEnclave
+TerminateJobObject
+TerminateProcess
+TerminateThread
+Thread32First
+Thread32Next
+TlsAlloc
+TlsFree
+TlsGetValue
+TlsSetValue
+Toolhelp32ReadProcessMemory
+TransactNamedPipe
+TransmitCommChar
+TryAcquireSRWLockExclusive
+TryAcquireSRWLockShared
+TryEnterCriticalSection
+TrySubmitThreadpoolCallback
+TzSpecificLocalTimeToSystemTime
+TzSpecificLocalTimeToSystemTimeEx
+UmsThreadYield
+UnhandledExceptionFilter
+UnlockFile
+UnlockFileEx
+UnmapViewOfFile
+UnmapViewOfFile2
+UnmapViewOfFileEx
+UnregisterApplicationRecoveryCallback
+UnregisterApplicationRestart
+UnregisterBadMemoryNotification
+UnregisterWait
+UnregisterWaitEx
+UnregisterWaitUntilOOBECompleted
+UpdateProcThreadAttribute
+UpdateResourceA
+UpdateResourceW
+VerLanguageNameA
+VerLanguageNameW
+VerSetConditionMask
+VerifyScripts
+VerifyVersionInfoA
+VerifyVersionInfoW
+VirtualAlloc
+VirtualAlloc2FromApp
+VirtualAllocEx
+VirtualAllocExNuma
+VirtualAllocFromApp
+VirtualFree
+VirtualFreeEx
+VirtualLock
+VirtualProtect
+VirtualProtectEx
+VirtualProtectFromApp
+VirtualQuery
+VirtualQueryEx
+VirtualUnlock
+WTSGetActiveConsoleSessionId
+WaitCommEvent
+WaitForDebugEvent
+WaitForDebugEventEx
+WaitForMultipleObjects
+WaitForMultipleObjectsEx
+WaitForSingleObject
+WaitForSingleObjectEx
+WaitForThreadpoolIoCallbacks
+WaitForThreadpoolTimerCallbacks
+WaitForThreadpoolWaitCallbacks
+WaitForThreadpoolWorkCallbacks
+WaitNamedPipeA
+WaitNamedPipeW
+WaitOnAddress
+WakeAllConditionVariable
+WakeByAddressAll
+WakeByAddressSingle
+WakeConditionVariable
+WerGetFlags
+WerRegisterAdditionalProcess
+WerRegisterAppLocalDump
+WerRegisterCustomMetadata
+WerRegisterExcludedMemoryBlock
+WerRegisterFile
+WerRegisterMemoryBlock
+WerRegisterRuntimeExceptionModule
+WerSetFlags
+WerUnregisterAdditionalProcess
+WerUnregisterAppLocalDump
+WerUnregisterExcludedMemoryBlock
+WerUnregisterFile
+WerUnregisterMemoryBlock
+WerUnregisterRuntimeExceptionModule
+WideCharToMultiByte
+WinExec
+Wow64DisableWow64FsRedirection
+Wow64GetThreadSelectorEntry
+Wow64RevertWow64FsRedirection
+Wow64SuspendThread
+WriteFile
+WriteFileEx
+WriteFileGather
+WritePrivateProfileSectionA
+WritePrivateProfileSectionW
+WritePrivateProfileStringA
+WritePrivateProfileStringW
+WritePrivateProfileStructA
+WritePrivateProfileStructW
+WriteProcessMemory
+WriteProfileSectionA
+WriteProfileSectionW
+WriteProfileStringA
+WriteProfileStringW
+WriteTapemark
+ZombifyActCtx
+_lclose
+_lcreat
+_llseek
+_lopen
+_lread
+_lwrite
+if_nametoindex
+lstrcatA
+lstrcatW
+lstrcmpA
+lstrcmpW
+lstrcmpiA
+lstrcmpiW
+lstrcpyA
+lstrcpyW
+lstrcpynA
+lstrcpynW
+lstrlenA
+lstrlenW
+timeBeginPeriod
+timeEndPeriod
+timeGetDevCaps
+timeGetSystemTime
+timeGetTime
+uaw_wcslen
diff --git a/crates/exav-pe-emu/src/exports/ntdll.txt b/crates/exav-pe-emu/src/exports/ntdll.txt
new file mode 100644
index 0000000..2a68b6e
--- /dev/null
+++ b/crates/exav-pe-emu/src/exports/ntdll.txt
@@ -0,0 +1,133 @@
+DbgBreakPoint
+DbgPrint
+DbgPrintEx
+DbgPrompt
+EtwActivityIdControl
+EtwUnregister
+EtwWriteTransfer
+GetCurrentProcessorNumber
+NtClose
+NtCreateFile
+NtCurrentTeb
+NtDeviceIoControlFile
+NtNotifyChangeMultipleKeys
+NtOpenFile
+NtQueryInformationProcess
+NtQueryInformationThread
+NtQueryMultipleValueKey
+NtQueryObject
+NtQuerySystemInformation
+NtQuerySystemTime
+NtRenameKey
+NtSetInformationKey
+NtWaitForSingleObject
+ReleaseSRWLockShared
+RtlAbsoluteToSelfRelativeSD
+RtlAddAce
+RtlAddFunctionTable
+RtlAddGrowableFunctionTable
+RtlAllocateHeap
+RtlAnsiStringToUnicodeString
+RtlAppendUnicodeToString
+RtlCaptureContext
+RtlCaptureStackBackTrace
+RtlCharToInteger
+RtlClearAllBits
+RtlCompareMemory
+RtlCompareMemoryUlong
+RtlCompareString
+RtlConvertDeviceFamilyInfoToString
+RtlConvertSidToUnicodeString
+RtlCopyMemory
+RtlCopyMemoryNonTemporal
+RtlCopySid
+RtlCopyUnicodeString
+RtlCreateHeap
+RtlCreateSecurityDescriptor
+RtlCreateUnicodeString
+RtlDecompressBuffer
+RtlDeleteFunctionTable
+RtlDeleteGrowableFunctionTable
+RtlDowncaseUnicodeChar
+RtlEqualPrefixSid
+RtlEqualSid
+RtlEqualString
+RtlEqualUnicodeString
+RtlEthernetAddressToStringA
+RtlEthernetAddressToStringW
+RtlEthernetStringToAddressA
+RtlEthernetStringToAddressW
+RtlFillMemory
+RtlFirstEntrySList
+RtlFreeAnsiString
+RtlFreeOemString
+RtlFreeUnicodeString
+RtlGUIDFromString
+RtlGetAce
+RtlGetEnabledExtendedFeatures
+RtlGetOwnerSecurityDescriptor
+RtlGrowFunctionTable
+RtlInitString
+RtlInitUnicodeString
+RtlInitializeBitMap
+RtlInitializeSListHead
+RtlInitializeSid
+RtlInstallFunctionTableCallback
+RtlIntegerToUnicodeString
+RtlInterlockedFlushSList
+RtlInterlockedPopEntrySList
+RtlInterlockedPushEntrySList
+RtlIpv4AddressToStringA
+RtlIpv4AddressToStringExA
+RtlIpv4AddressToStringExW
+RtlIpv4AddressToStringW
+RtlIpv4StringToAddressA
+RtlIpv4StringToAddressExA
+RtlIpv4StringToAddressExW
+RtlIpv4StringToAddressW
+RtlIpv6AddressToStringA
+RtlIpv6AddressToStringExA
+RtlIpv6AddressToStringExW
+RtlIpv6AddressToStringW
+RtlIpv6StringToAddressA
+RtlIpv6StringToAddressExA
+RtlIpv6StringToAddressExW
+RtlIpv6StringToAddressW
+RtlIsCloudFilesPlaceholder
+RtlIsNameLegalDOS8Dot3
+RtlLengthRequiredSid
+RtlLengthSid
+RtlLocalTimeToSystemTime
+RtlLookupFunctionEntry
+RtlMultiByteToUnicodeN
+RtlNtStatusToDosError
+RtlNumberOfSetBits
+RtlPcToFileHeader
+RtlQueryDepthSList
+RtlRaiseException
+RtlRestoreContext
+RtlSetBits
+RtlSetDaclSecurityDescriptor
+RtlSetGroupSecurityDescriptor
+RtlSetOwnerSecurityDescriptor
+RtlStringFromGUID
+RtlSubAuthoritySid
+RtlTimeToSecondsSince1970
+RtlTimeToTimeFields
+RtlUnicodeStringToAnsiString
+RtlUnicodeStringToInteger
+RtlUnicodeStringToOemString
+RtlUnicodeToMultiByteSize
+RtlUniform
+RtlUnwind
+RtlUnwindEx
+RtlUpcaseUnicodeChar
+RtlUpcaseUnicodeString
+RtlValidSid
+RtlVerifyVersionInfo
+RtlVirtualUnwind
+TryAcquireSRWLockShared
+UnhandledExceptionFilter
+VerSetConditionMask
+vDbgPrintEx
+vDbgPrintExWithPrefix
diff --git a/crates/exav-pe-emu/src/exports/user32.txt b/crates/exav-pe-emu/src/exports/user32.txt
new file mode 100644
index 0000000..ec00b7c
--- /dev/null
+++ b/crates/exav-pe-emu/src/exports/user32.txt
@@ -0,0 +1,755 @@
+ActivateKeyboardLayout
+AddClipboardFormatListener
+AdjustWindowRect
+AdjustWindowRectEx
+AdjustWindowRectExForDpi
+AllowSetForegroundWindow
+AnimateWindow
+AnyPopup
+AppendMenuA
+AppendMenuW
+AreDpiAwarenessContextsEqual
+ArrangeIconicWindows
+AttachThreadInput
+BeginDeferWindowPos
+BeginPaint
+BlockInput
+BringWindowToTop
+BroadcastSystemMessage
+BroadcastSystemMessageA
+BroadcastSystemMessageExA
+BroadcastSystemMessageExW
+BroadcastSystemMessageW
+CalculatePopupWindowPosition
+CallMsgFilterA
+CallMsgFilterW
+CallNextHookEx
+CallWindowProcA
+CallWindowProcW
+CascadeWindows
+ChangeClipboardChain
+ChangeDisplaySettingsA
+ChangeDisplaySettingsExA
+ChangeDisplaySettingsExW
+ChangeDisplaySettingsW
+ChangeWindowMessageFilter
+ChangeWindowMessageFilterEx
+CharLowerA
+CharLowerBuffA
+CharLowerBuffW
+CharLowerW
+CharNextA
+CharNextExA
+CharNextW
+CharPrevA
+CharPrevExA
+CharPrevW
+CharToOemA
+CharToOemBuffA
+CharToOemBuffW
+CharToOemW
+CharUpperA
+CharUpperBuffA
+CharUpperBuffW
+CharUpperW
+CheckDlgButton
+CheckMenuItem
+CheckMenuRadioItem
+CheckRadioButton
+ChildWindowFromPoint
+ChildWindowFromPointEx
+ClientToScreen
+ClipCursor
+CloseClipboard
+CloseDesktop
+CloseGestureInfoHandle
+CloseTouchInputHandle
+CloseWindow
+CloseWindowStation
+CopyAcceleratorTableA
+CopyAcceleratorTableW
+CopyIcon
+CopyImage
+CopyRect
+CountClipboardFormats
+CreateAcceleratorTableA
+CreateAcceleratorTableW
+CreateCaret
+CreateCursor
+CreateDesktopA
+CreateDesktopExA
+CreateDesktopExW
+CreateDesktopW
+CreateDialogA
+CreateDialogIndirectA
+CreateDialogIndirectParamA
+CreateDialogIndirectParamW
+CreateDialogIndirectW
+CreateDialogParamA
+CreateDialogParamW
+CreateDialogW
+CreateIcon
+CreateIconFromResource
+CreateIconFromResourceEx
+CreateIconIndirect
+CreateMDIWindowA
+CreateMDIWindowW
+CreateMenu
+CreatePopupMenu
+CreateSyntheticPointerDevice
+CreateWindowExA
+CreateWindowExW
+CreateWindowStationA
+CreateWindowStationW
+DdeAbandonTransaction
+DdeAccessData
+DdeAddData
+DdeClientTransaction
+DdeCmpStringHandles
+DdeConnect
+DdeConnectList
+DdeCreateDataHandle
+DdeCreateStringHandleA
+DdeCreateStringHandleW
+DdeDisconnect
+DdeDisconnectList
+DdeEnableCallback
+DdeFreeDataHandle
+DdeFreeStringHandle
+DdeGetData
+DdeGetLastError
+DdeImpersonateClient
+DdeInitializeA
+DdeInitializeW
+DdeKeepStringHandle
+DdeNameService
+DdePostAdvise
+DdeQueryConvInfo
+DdeQueryNextServer
+DdeQueryStringA
+DdeQueryStringW
+DdeReconnect
+DdeSetQualityOfService
+DdeSetUserHandle
+DdeUnaccessData
+DdeUninitialize
+DefDlgProcA
+DefDlgProcW
+DefFrameProcA
+DefFrameProcW
+DefMDIChildProcA
+DefMDIChildProcW
+DefRawInputProc
+DefWindowProcA
+DefWindowProcW
+DeferWindowPos
+DeleteMenu
+DeregisterShellHookWindow
+DestroyAcceleratorTable
+DestroyCaret
+DestroyCursor
+DestroyIcon
+DestroyMenu
+DestroySyntheticPointerDevice
+DestroyWindow
+DialogBoxA
+DialogBoxIndirectA
+DialogBoxIndirectParamA
+DialogBoxIndirectParamW
+DialogBoxIndirectW
+DialogBoxParamA
+DialogBoxParamW
+DialogBoxW
+DisableProcessWindowsGhosting
+DispatchMessage
+DispatchMessageA
+DispatchMessageW
+DisplayConfigGetDeviceInfo
+DisplayConfigSetDeviceInfo
+DlgDirListA
+DlgDirListComboBoxA
+DlgDirListComboBoxW
+DlgDirListW
+DlgDirSelectComboBoxExA
+DlgDirSelectComboBoxExW
+DlgDirSelectExA
+DlgDirSelectExW
+DragDetect
+DrawAnimatedRects
+DrawCaption
+DrawEdge
+DrawFocusRect
+DrawFrameControl
+DrawIcon
+DrawIconEx
+DrawMenuBar
+DrawStateA
+DrawStateW
+DrawText
+DrawTextA
+DrawTextExA
+DrawTextExW
+DrawTextW
+EmptyClipboard
+EnableMenuItem
+EnableMouseInPointer
+EnableNonClientDpiScaling
+EnableScrollBar
+EnableWindow
+EndDeferWindowPos
+EndDialog
+EndMenu
+EndPaint
+EndTask
+EnumChildWindows
+EnumClipboardFormats
+EnumDesktopWindows
+EnumDesktopsA
+EnumDesktopsW
+EnumDisplayDevicesA
+EnumDisplayDevicesW
+EnumDisplayMonitors
+EnumDisplaySettingsA
+EnumDisplaySettingsExA
+EnumDisplaySettingsExW
+EnumDisplaySettingsW
+EnumPropsA
+EnumPropsExA
+EnumPropsExW
+EnumPropsW
+EnumThreadWindows
+EnumWindowStationsA
+EnumWindowStationsW
+EnumWindows
+EqualRect
+EvaluateProximityToPolygon
+EvaluateProximityToRect
+ExcludeUpdateRgn
+ExitWindowsEx
+FillRect
+FindWindowA
+FindWindowExA
+FindWindowExW
+FindWindowW
+FlashWindow
+FlashWindowEx
+FrameRect
+FreeDDElParam
+GetActiveWindow
+GetAltTabInfoA
+GetAltTabInfoW
+GetAncestor
+GetAsyncKeyState
+GetAutoRotationState
+GetAwarenessFromDpiAwarenessContext
+GetCIMSSM
+GetCapture
+GetCaretBlinkTime
+GetCaretPos
+GetClassInfoA
+GetClassInfoExA
+GetClassInfoExW
+GetClassInfoW
+GetClassLongA
+GetClassLongPtrA
+GetClassLongPtrW
+GetClassLongW
+GetClassName
+GetClassNameA
+GetClassNameW
+GetClassWord
+GetClientRect
+GetClipCursor
+GetClipboardData
+GetClipboardFormatNameA
+GetClipboardFormatNameW
+GetClipboardOwner
+GetClipboardSequenceNumber
+GetClipboardViewer
+GetComboBoxInfo
+GetCurrentInputMessageSource
+GetCursor
+GetCursorInfo
+GetCursorPos
+GetDC
+GetDCEx
+GetDesktopWindow
+GetDialogBaseUnits
+GetDialogControlDpiChangeBehavior
+GetDialogDpiChangeBehavior
+GetDisplayAutoRotationPreferences
+GetDisplayConfigBufferSizes
+GetDlgCtrlID
+GetDlgItem
+GetDlgItemInt
+GetDlgItemTextA
+GetDlgItemTextW
+GetDoubleClickTime
+GetDpiAwarenessContextForProcess
+GetDpiForSystem
+GetDpiForWindow
+GetDpiFromDpiAwarenessContext
+GetFocus
+GetForegroundWindow
+GetGUIThreadInfo
+GetGestureConfig
+GetGestureExtraArgs
+GetGestureInfo
+GetGuiResources
+GetIconInfo
+GetIconInfoExA
+GetIconInfoExW
+GetInputState
+GetKBCodePage
+GetKeyNameTextA
+GetKeyNameTextW
+GetKeyState
+GetKeyboardLayout
+GetKeyboardLayoutList
+GetKeyboardLayoutNameA
+GetKeyboardLayoutNameW
+GetKeyboardState
+GetKeyboardType
+GetLastActivePopup
+GetLastInputInfo
+GetLayeredWindowAttributes
+GetListBoxInfo
+GetMenu
+GetMenuBarInfo
+GetMenuCheckMarkDimensions
+GetMenuContextHelpId
+GetMenuDefaultItem
+GetMenuInfo
+GetMenuItemCount
+GetMenuItemID
+GetMenuItemInfoA
+GetMenuItemInfoW
+GetMenuItemRect
+GetMenuState
+GetMenuStringA
+GetMenuStringW
+GetMessage
+GetMessageA
+GetMessageExtraInfo
+GetMessagePos
+GetMessageTime
+GetMessageW
+GetMonitorInfoA
+GetMonitorInfoW
+GetMouseMovePointsEx
+GetNextDlgGroupItem
+GetNextDlgTabItem
+GetOpenClipboardWindow
+GetParent
+GetPhysicalCursorPos
+GetPointerCursorId
+GetPointerDevice
+GetPointerDeviceCursors
+GetPointerDeviceProperties
+GetPointerDeviceRects
+GetPointerDevices
+GetPointerFrameInfo
+GetPointerFrameInfoHistory
+GetPointerFramePenInfo
+GetPointerFramePenInfoHistory
+GetPointerFrameTouchInfo
+GetPointerFrameTouchInfoHistory
+GetPointerInfo
+GetPointerInfoHistory
+GetPointerInputTransform
+GetPointerPenInfo
+GetPointerPenInfoHistory
+GetPointerTouchInfo
+GetPointerTouchInfoHistory
+GetPointerType
+GetPriorityClipboardFormat
+GetProcessDefaultLayout
+GetProcessWindowStation
+GetPropA
+GetPropW
+GetQueueStatus
+GetRawInputBuffer
+GetRawInputData
+GetRawInputDeviceInfoA
+GetRawInputDeviceInfoW
+GetRawInputDeviceList
+GetRawPointerDeviceData
+GetRegisteredRawInputDevices
+GetScrollBarInfo
+GetScrollInfo
+GetScrollPos
+GetScrollRange
+GetShellWindow
+GetSubMenu
+GetSysColor
+GetSysColorBrush
+GetSystemDpiForProcess
+GetSystemMenu
+GetSystemMetrics
+GetSystemMetricsForDpi
+GetTabbedTextExtentA
+GetTabbedTextExtentW
+GetThreadDesktop
+GetThreadDpiAwarenessContext
+GetThreadDpiHostingBehavior
+GetTitleBarInfo
+GetTopWindow
+GetTouchInputInfo
+GetUnpredictedMessagePos
+GetUpdateRect
+GetUpdateRgn
+GetUpdatedClipboardFormats
+GetUserObjectInformationA
+GetUserObjectInformationW
+GetUserObjectSecurity
+GetWindow
+GetWindowContextHelpId
+GetWindowDC
+GetWindowDisplayAffinity
+GetWindowDpiAwarenessContext
+GetWindowDpiHostingBehavior
+GetWindowFeedbackSetting
+GetWindowInfo
+GetWindowLongA
+GetWindowLongPtrA
+GetWindowLongPtrW
+GetWindowLongW
+GetWindowModuleFileNameA
+GetWindowModuleFileNameW
+GetWindowPlacement
+GetWindowRect
+GetWindowRgn
+GetWindowRgnBox
+GetWindowTextA
+GetWindowTextLengthA
+GetWindowTextLengthW
+GetWindowTextW
+GetWindowThreadProcessId
+GetWindowWord
+GrayStringA
+GrayStringW
+HideCaret
+HiliteMenuItem
+ImpersonateDdeClientWindow
+InSendMessage
+InSendMessageEx
+InflateRect
+InheritWindowMonitor
+InitializeTouchInjection
+InjectSyntheticPointerInput
+InjectTouchInput
+InsertMenuA
+InsertMenuItemA
+InsertMenuItemW
+InsertMenuW
+InternalGetWindowText
+IntersectRect
+InvalidateRect
+InvalidateRgn
+InvertRect
+IsCharAlphaA
+IsCharAlphaNumericA
+IsCharAlphaNumericW
+IsCharAlphaW
+IsCharLowerA
+IsCharLowerW
+IsCharUpperA
+IsCharUpperW
+IsChild
+IsClipboardFormatAvailable
+IsDialogMessageA
+IsDialogMessageW
+IsDlgButtonChecked
+IsGUIThread
+IsHungAppWindow
+IsIconic
+IsImmersiveProcess
+IsMenu
+IsMouseInPointerEnabled
+IsProcessDPIAware
+IsRectEmpty
+IsTouchWindow
+IsValidDpiAwarenessContext
+IsWinEventHookInstalled
+IsWindow
+IsWindowArranged
+IsWindowEnabled
+IsWindowUnicode
+IsWindowVisible
+IsWow64Message
+IsZoomed
+KillTimer
+LoadAcceleratorsA
+LoadAcceleratorsW
+LoadBitmapA
+LoadBitmapW
+LoadCursorA
+LoadCursorFromFileA
+LoadCursorFromFileW
+LoadCursorW
+LoadIconA
+LoadIconW
+LoadImageA
+LoadImageW
+LoadKeyboardLayoutA
+LoadKeyboardLayoutW
+LoadMenuA
+LoadMenuIndirectA
+LoadMenuIndirectW
+LoadMenuW
+LoadStringA
+LoadStringW
+LockSetForegroundWindow
+LockWindowUpdate
+LockWorkStation
+LogicalToPhysicalPoint
+LogicalToPhysicalPointForPerMonitorDPI
+LookupIconIdFromDirectory
+LookupIconIdFromDirectoryEx
+MapDialogRect
+MapVirtualKeyA
+MapVirtualKeyExA
+MapVirtualKeyExW
+MapVirtualKeyW
+MapWindowPoints
+MenuItemFromPoint
+MessageBeep
+MessageBox
+MessageBoxA
+MessageBoxExA
+MessageBoxExW
+MessageBoxIndirectA
+MessageBoxIndirectW
+MessageBoxW
+ModifyMenuA
+ModifyMenuW
+MonitorFromPoint
+MonitorFromRect
+MonitorFromWindow
+MoveWindow
+MsgWaitForMultipleObjects
+MsgWaitForMultipleObjectsEx
+NotifyWinEvent
+OemKeyScan
+OemToCharA
+OemToCharBuffA
+OemToCharBuffW
+OemToCharW
+OffsetRect
+OpenClipboard
+OpenDesktopA
+OpenDesktopW
+OpenIcon
+OpenInputDesktop
+OpenWindowStationA
+OpenWindowStationW
+PackDDElParam
+PackTouchHitTestingProximityEvaluation
+PaintDesktop
+PeekMessageA
+PeekMessageW
+PhysicalToLogicalPoint
+PhysicalToLogicalPointForPerMonitorDPI
+PostMessageA
+PostMessageW
+PostQuitMessage
+PostThreadMessageA
+PostThreadMessageW
+PrintWindow
+PrivateExtractIconsA
+PrivateExtractIconsW
+PtInRect
+QueryDisplayConfig
+RealChildWindowFromPoint
+RealGetWindowClassA
+RealGetWindowClassW
+RedrawWindow
+RegisterClassA
+RegisterClassExA
+RegisterClassExW
+RegisterClassW
+RegisterClipboardFormatA
+RegisterClipboardFormatW
+RegisterDeviceNotificationA
+RegisterDeviceNotificationW
+RegisterHotKey
+RegisterPointerDeviceNotifications
+RegisterPointerInputTarget
+RegisterPointerInputTargetEx
+RegisterPowerSettingNotification
+RegisterRawInputDevices
+RegisterShellHookWindow
+RegisterSuspendResumeNotification
+RegisterTouchHitTestingWindow
+RegisterTouchWindow
+RegisterWindowMessageA
+RegisterWindowMessageW
+ReleaseCapture
+ReleaseDC
+RemoveClipboardFormatListener
+RemoveMenu
+RemovePropA
+RemovePropW
+ReplyMessage
+ReuseDDElParam
+ScreenToClient
+ScrollDC
+ScrollWindow
+ScrollWindowEx
+SendDlgItemMessageA
+SendDlgItemMessageW
+SendIMEMessageExA
+SendIMEMessageExW
+SendInput
+SendMessage
+SendMessageA
+SendMessageCallbackA
+SendMessageCallbackW
+SendMessageTimeoutA
+SendMessageTimeoutW
+SendMessageW
+SendNotifyMessageA
+SendNotifyMessageW
+SetActiveWindow
+SetCapture
+SetCaretBlinkTime
+SetCaretPos
+SetClassLongA
+SetClassLongPtrA
+SetClassLongPtrW
+SetClassLongW
+SetClassWord
+SetClipboardData
+SetClipboardViewer
+SetCoalescableTimer
+SetCursor
+SetCursorPos
+SetDialogDpiChangeBehavior
+SetDisplayAutoRotationPreferences
+SetDisplayConfig
+SetDlgItemInt
+SetDlgItemTextA
+SetDlgItemTextW
+SetDoubleClickTime
+SetFocus
+SetForegroundWindow
+SetGestureConfig
+SetKeyboardState
+SetLastErrorEx
+SetLayeredWindowAttributes
+SetMenu
+SetMenuContextHelpId
+SetMenuDefaultItem
+SetMenuInfo
+SetMenuItemBitmaps
+SetMenuItemInfoA
+SetMenuItemInfoW
+SetMessageExtraInfo
+SetParent
+SetPhysicalCursorPos
+SetProcessDPIAware
+SetProcessDefaultLayout
+SetProcessDpiAwarenessContext
+SetProcessRestrictionExemption
+SetProcessWindowStation
+SetPropA
+SetPropW
+SetRect
+SetRectEmpty
+SetScrollInfo
+SetScrollPos
+SetScrollRange
+SetSysColors
+SetSystemCursor
+SetThreadCursorCreationScaling
+SetThreadDesktop
+SetThreadDpiAwarenessContext
+SetThreadDpiHostingBehavior
+SetTimer
+SetUserObjectInformationA
+SetUserObjectInformationW
+SetUserObjectSecurity
+SetWinEventHook
+SetWindowContextHelpId
+SetWindowDisplayAffinity
+SetWindowFeedbackSetting
+SetWindowLongA
+SetWindowLongPtrA
+SetWindowLongPtrW
+SetWindowLongW
+SetWindowPlacement
+SetWindowPos
+SetWindowRgn
+SetWindowTextA
+SetWindowTextW
+SetWindowsHookExA
+SetWindowsHookExW
+ShowCaret
+ShowCursor
+ShowOwnedPopups
+ShowScrollBar
+ShowWindow
+ShowWindowAsync
+ShutdownBlockReasonCreate
+ShutdownBlockReasonDestroy
+ShutdownBlockReasonQuery
+SkipPointerFrameMessages
+SoundSentry
+SubtractRect
+SwapMouseButton
+SwitchDesktop
+SwitchToThisWindow
+SystemParametersInfoA
+SystemParametersInfoForDpi
+SystemParametersInfoW
+TabbedTextOutA
+TabbedTextOutW
+TileWindows
+ToAscii
+ToAsciiEx
+ToUnicode
+ToUnicodeEx
+TrackMouseEvent
+TrackPopupMenu
+TrackPopupMenuEx
+TranslateAcceleratorA
+TranslateAcceleratorW
+TranslateMDISysAccel
+TranslateMessage
+UnhookWinEvent
+UnhookWindowsHookEx
+UnionRect
+UnloadKeyboardLayout
+UnpackDDElParam
+UnregisterClassA
+UnregisterClassW
+UnregisterDeviceNotification
+UnregisterHotKey
+UnregisterPointerInputTarget
+UnregisterPointerInputTargetEx
+UnregisterPowerSettingNotification
+UnregisterSuspendResumeNotification
+UnregisterTouchWindow
+UpdateLayeredWindow
+UpdateWindow
+UserHandleGrantAccess
+ValidateRect
+ValidateRgn
+VkKeyScanA
+VkKeyScanExA
+VkKeyScanExW
+VkKeyScanW
+WINNLSEnableIME
+WaitForInputIdle
+WaitMessage
+WinHelpA
+WinHelpW
+WindowFromDC
+WindowFromPhysicalPoint
+WindowFromPoint
+keybd_event
+mouse_event
+wsprintfA
+wsprintfW
+wvsprintfA
+wvsprintfW
diff --git a/crates/exav-pe-emu/src/image.rs b/crates/exav-pe-emu/src/image.rs
index c97a441..fca6fd1 100644
--- a/crates/exav-pe-emu/src/image.rs
+++ b/crates/exav-pe-emu/src/image.rs
@@ -2,10 +2,17 @@
//!
//! Loading follows what the Windows loader does to the parts a stub can
//! observe: headers at the image base, each section at its virtual address,
-//! zero-fill where the virtual size exceeds the raw size. Nothing else — no
-//! relocations (the emulator maps at the image's preferred base, so there are
-//! none to apply), no import binding (the stub resolves its own), no TLS
-//! callbacks.
+//! zero-fill where the virtual size exceeds the raw size. No relocations (the
+//! emulator maps at the image's preferred base, so there are none to apply) and
+//! no import binding here (the stub resolves its own, with a hand from
+//! [`crate::win::Env::bind_imports`]).
+//!
+//! The one piece of loader work this module parses but [`crate::run`] performs
+//! is the **TLS directory** (data directory 9): its callbacks run, with
+//! `DLL_PROCESS_ATTACH`, before the entry point, because a packer can put its
+//! unpacking there precisely so a tool that starts at the entry point sees
+//! nothing. [`PeImage::tls_dir`] is the directory's `(rva, size)`; the run
+//! driver reads the `IMAGE_TLS_DIRECTORY32` it points at.
//!
//! Dumping is the reverse, with one deliberate difference: the dump is written
//! in **memory layout**, with `PointerToRawData == VirtualAddress` and the file
@@ -46,6 +53,10 @@ pub struct PeImage {
/// functions its stub needs, and the *loader* — not the stub — fills those
/// slots in. Emulating that binding is what lets the stub call them.
pub import_dir: (u32, u32),
+ /// TLS directory (RVA, size), data directory 9. Zero when absent. The run
+ /// driver reads the `IMAGE_TLS_DIRECTORY32` here and runs its callbacks
+ /// before the entry point, as the Windows loader does.
+ pub tls_dir: (u32, u32),
pub sections: Vec,
/// Offset of the section table within the file, so the dump can patch it.
sec_table_off: usize,
@@ -105,6 +116,15 @@ impl PeImage {
} else {
(0, 0)
};
+ // Data directory 9 is the TLS directory, at opt + 96 + 9 * 8.
+ let tls_dir = if num_dirs >= 10 {
+ (
+ u32_at(data, opt + 168).unwrap_or(0),
+ u32_at(data, opt + 172).unwrap_or(0),
+ )
+ } else {
+ (0, 0)
+ };
let mut sections = Vec::with_capacity(num_sections);
for i in 0..num_sections {
@@ -140,6 +160,7 @@ impl PeImage {
file_align,
is_dll,
import_dir,
+ tls_dir,
sections,
sec_table_off,
pe_off,
diff --git a/crates/exav-pe-emu/src/run.rs b/crates/exav-pe-emu/src/run.rs
index 2d886e6..09f6cd2 100644
--- a/crates/exav-pe-emu/src/run.rs
+++ b/crates/exav-pe-emu/src/run.rs
@@ -35,6 +35,23 @@
//! handler, and resumes from the context the handler leaves behind — including
//! any registers or instruction pointer it edited, which is exactly the
//! mechanism those stubs are using.
+//!
+//! ## TLS callbacks
+//!
+//! The Windows loader runs a module's TLS callbacks before its entry point, so
+//! a packer can hide its unpacking there to defeat a tool that starts at the
+//! entry point. The driver does the same: it sets up the static TLS block,
+//! writes the index to `AddressOfIndex`, points the TEB's
+//! `ThreadLocalStoragePointer` at it, then calls each callback as
+//! `cb(image_base, DLL_PROCESS_ATTACH, 0)`, re-reading the callback array after
+//! each one as the loader does (a callback may extend it). Only then does it
+//! start at the entry point. The directory layout, the TEB+0x2C TLS array and
+//! the callback prototype are as Microsoft's PE Format specification gives them
+//! (section "The .tls Section"). A callback that faults or raises goes through the
+//! same SEH machinery as the stub. If nothing handles it, or a callback runs
+//! past its slice of the budget, or the callback count cap is hit, the TLS
+//! phase is abandoned and execution proceeds to the entry point rather than
+//! ending the run: the payload is still worth trying to recover from there.
use crate::cpu::{Cpu, Stop, EAX, EBX, ESP};
use crate::image::PeImage;
@@ -80,6 +97,24 @@ const MIN_WRITE_SPREAD: u32 = 6;
/// skewed, so a run that makes many of them is not executing anything real.
const MAX_UNIMPLEMENTED_CALLS: u32 = 64;
+/// Most TLS callbacks a run will invoke before giving up on the rest and
+/// starting the entry point. A real image has one or two; a hostile directory
+/// can name far more, or point its array at itself.
+const MAX_TLS_CALLBACKS: u32 = 64;
+
+/// Fraction of the whole instruction budget any single TLS callback may spend.
+/// A callback is bounded so a stub cannot park the emulator in one forever, but
+/// generously, since a packer that unpacks from a callback does real work there.
+const TLS_CALLBACK_BUDGET_DIVISOR: u64 = 8;
+
+/// Largest static TLS block the loader will build, so a crafted
+/// `SizeOfZeroFill` cannot demand an arbitrary allocation.
+const MAX_TLS_BLOCK: u32 = 1 << 20;
+
+/// `DLL_PROCESS_ATTACH`, the reason a TLS callback and `DllMain` receive at
+/// process start.
+const DLL_PROCESS_ATTACH: u32 = 1;
+
/// Everything that bounds a run.
///
/// This is the sandbox's contract. The emulator follows control flow supplied
@@ -218,32 +253,39 @@ pub fn unpack(file: &[u8], limits: &EmuLimits) -> Report {
let _ = env.bind_imports(&mut mem, image.base, dir_rva, dir_size);
let mut cpu = Cpu::new();
- cpu.eip = image.base.wrapping_add(image.entry_rva);
- cpu.regs[ESP] = INITIAL_ESP;
cpu.fs_base = TEB_BASE;
- // What a thread sees at the entry point on Windows: EBX holds the PEB, and
- // the return address is into kernel32.
- cpu.regs[EBX] = crate::win::PEB_BASE;
let process_return = env.process_return();
let seh_return = env.seh_return();
- // A DLL is entered as `DllMain(hinstDLL, DLL_PROCESS_ATTACH, NULL)`. Those
- // three arguments have to be on the stack: a packed DLL's stub reads them,
- // and without them it faults on its first instruction.
- let pushed = if image.is_dll {
- cpu.push32(&mut mem, 0)
- .and_then(|()| cpu.push32(&mut mem, 1))
- .and_then(|()| cpu.push32(&mut mem, image.base))
- .and_then(|()| cpu.push32(&mut mem, process_return))
- } else {
- cpu.push32(&mut mem, process_return)
+ let tls_return = env.tls_return();
+ let image_end = image.base.saturating_add(image.size_of_image);
+
+ // The loader runs TLS callbacks before the entry point. Set the static TLS
+ // block up and queue the callbacks; if there are none, start at the entry
+ // point straight away. `tls_cb_array` is the VA of the callback array, re-
+ // read before each call because a callback can grow it.
+ let tls_cb_array = setup_tls(&image, &mut env, &mut mem);
+ let mut tls_next: u32 = 0;
+ let mut tls_calls: u32 = 0;
+ let mut in_tls = false;
+ // Per-callback slice of the budget; a callback that outruns it is abandoned.
+ let tls_callback_budget = limits.max_ticks / TLS_CALLBACK_BUDGET_DIVISOR;
+ let mut tls_deadline: u64 = tls_callback_budget;
+
+ let start_ok = match tls_cb_array.and_then(|a| next_tls_callback(&mut mem, a, 0, &image)) {
+ Some(cb) => {
+ in_tls = true;
+ tls_next = 1;
+ tls_calls = 1;
+ enter_tls_callback(&mut cpu, &mut mem, cb, image.base, tls_return).is_ok()
+ }
+ None => start_entry(&mut cpu, &mut mem, &image, process_return).is_ok(),
};
- if pushed.is_err() {
+ if !start_ok {
report.stop = "stack is not mapped".to_string();
return report;
}
let stub_section = image.section_of(image.entry_rva);
- let image_end = image.base.saturating_add(image.size_of_image);
let mut seh = SehState {
seh_return,
@@ -275,8 +317,49 @@ pub fn unpack(file: &[u8], limits: &EmuLimits) -> Report {
}
progress_deadline = ticks + PROGRESS_WINDOW;
}
+ // A TLS callback that outran its slice of the budget. Abandon the rest
+ // of the TLS phase and start the entry point with what it produced.
+ if in_tls && ticks >= tls_deadline {
+ in_tls = false;
+ if start_entry(&mut cpu, &mut mem, &image, process_return).is_err() {
+ stop_reason = "stack is not mapped".to_string();
+ break;
+ }
+ continue;
+ }
let eip = cpu.eip;
+ if in_tls && eip == tls_return {
+ ticks += 1;
+ // A callback returned. The loader re-reads the array because a
+ // callback may have appended to it; take the next entry if there is
+ // one and the count cap allows, otherwise the TLS phase is done.
+ let next = if tls_calls < MAX_TLS_CALLBACKS {
+ tls_cb_array.and_then(|a| next_tls_callback(&mut mem, a, tls_next, &image))
+ } else {
+ None
+ };
+ match next {
+ Some(cb) => {
+ tls_next += 1;
+ tls_calls += 1;
+ tls_deadline = ticks + tls_callback_budget;
+ if enter_tls_callback(&mut cpu, &mut mem, cb, image.base, tls_return).is_err() {
+ stop_reason = "stack is not mapped".to_string();
+ break;
+ }
+ }
+ None => {
+ in_tls = false;
+ if start_entry(&mut cpu, &mut mem, &image, process_return).is_err() {
+ stop_reason = "stack is not mapped".to_string();
+ break;
+ }
+ }
+ }
+ continue;
+ }
+
if eip == process_return {
stop_reason = "the stub returned to the loader".to_string();
break;
@@ -509,6 +592,123 @@ pub fn unpack(file: &[u8], limits: &EmuLimits) -> Report {
report
}
+/// Point the CPU at the entry point with the stack a thread starts with: EBX at
+/// the PEB, and a return address (plus `DllMain`'s three arguments for a DLL).
+fn start_entry(
+ cpu: &mut Cpu,
+ mem: &mut Mem,
+ image: &PeImage,
+ process_return: u32,
+) -> Result<(), ()> {
+ cpu.eip = image.base.wrapping_add(image.entry_rva);
+ cpu.regs[ESP] = INITIAL_ESP;
+ cpu.regs[EBX] = crate::win::PEB_BASE;
+ // A DLL is entered as `DllMain(hinstDLL, DLL_PROCESS_ATTACH, NULL)`. Those
+ // three arguments have to be on the stack: a packed DLL's stub reads them,
+ // and without them it faults on its first instruction.
+ let pushed = if image.is_dll {
+ cpu.push32(mem, 0)
+ .and_then(|()| cpu.push32(mem, DLL_PROCESS_ATTACH))
+ .and_then(|()| cpu.push32(mem, image.base))
+ .and_then(|()| cpu.push32(mem, process_return))
+ } else {
+ cpu.push32(mem, process_return)
+ };
+ pushed.map_err(|_| ())
+}
+
+/// Enter a TLS callback as `cb(image_base, DLL_PROCESS_ATTACH, 0)`, returning to
+/// `tls_return` so the driver can run the next one.
+fn enter_tls_callback(
+ cpu: &mut Cpu,
+ mem: &mut Mem,
+ callback: u32,
+ image_base: u32,
+ tls_return: u32,
+) -> Result<(), ()> {
+ cpu.regs[ESP] = INITIAL_ESP;
+ cpu.push32(mem, 0) // reserved
+ .and_then(|()| cpu.push32(mem, DLL_PROCESS_ATTACH))
+ .and_then(|()| cpu.push32(mem, image_base))
+ .and_then(|()| cpu.push32(mem, tls_return))
+ .map_err(|_| ())?;
+ cpu.eip = callback;
+ Ok(())
+}
+
+/// Set up the static TLS block and return the VA of the callback array, or
+/// `None` when the directory is absent, malformed, or points outside the image.
+///
+/// The `IMAGE_TLS_DIRECTORY32` fields are virtual addresses (the image is mapped
+/// at its preferred base, so a VA is `base + RVA`). Every one is bounds-checked
+/// against the mapped image before it is dereferenced, since a packed file's TLS
+/// directory is attacker-controlled.
+fn setup_tls(image: &PeImage, env: &mut Env, mem: &mut Mem) -> Option {
+ let (rva, size) = image.tls_dir;
+ if rva == 0 || size < 0x18 {
+ return None;
+ }
+ let image_end = image.base.saturating_add(image.size_of_image);
+ let in_image = |va: u32| va >= image.base && va < image_end;
+ let td = image.base.wrapping_add(rva);
+ if !in_image(td) || !mem.is_mapped(td, 0x18) {
+ return None;
+ }
+ let raw_start = mem.read_u32(td).ok()?;
+ let raw_end = mem.read_u32(td + 4).ok()?;
+ let index_va = mem.read_u32(td + 8).ok()?;
+ let cb_array = mem.read_u32(td + 12).ok()?;
+ let zero_fill = mem.read_u32(td + 16).ok()?;
+
+ // The static TLS template: the raw data, then the zero fill. A directory
+ // whose raw range is backwards or outside the image contributes no data;
+ // the block is still created so `AddressOfIndex` and the TEB are wired up.
+ let mut template = Vec::new();
+ if raw_end > raw_start && in_image(raw_start) && in_image(raw_end) {
+ let len = (raw_end - raw_start).min(MAX_TLS_BLOCK);
+ if mem.is_mapped(raw_start, len) {
+ template = mem.snapshot(raw_start, len as usize);
+ }
+ }
+ let total = (template.len() as u32)
+ .saturating_add(zero_fill)
+ .min(MAX_TLS_BLOCK);
+ template.resize(total as usize, 0);
+
+ // `AddressOfIndex` must be writable storage inside the image; a directory
+ // that points it elsewhere gets no index written, matching a loader that
+ // would fault and abandon the module rather than scribble out of bounds.
+ let index_va = if index_va != 0 && in_image(index_va) && mem.is_mapped(index_va, 4) {
+ index_va
+ } else {
+ 0
+ };
+ env.install_static_tls(mem, &template, 0, index_va).ok()??;
+
+ if cb_array != 0 && in_image(cb_array) && mem.is_mapped(cb_array, 4) {
+ Some(cb_array)
+ } else {
+ None
+ }
+}
+
+/// The `idx`-th callback in the array at `cb_array`, if it is present, non-null
+/// and points into the image. Re-read every time because a callback can extend
+/// the array.
+fn next_tls_callback(mem: &mut Mem, cb_array: u32, idx: u32, image: &PeImage) -> Option {
+ let slot = cb_array.wrapping_add(idx.wrapping_mul(4));
+ if !mem.is_mapped(slot, 4) {
+ return None;
+ }
+ let cb = mem.read_u32(slot).ok()?;
+ let image_end = image.base.saturating_add(image.size_of_image);
+ if cb != 0 && cb >= image.base && cb < image_end {
+ Some(cb)
+ } else {
+ None
+ }
+}
+
/// Whether the section execution just entered was *rebuilt* rather than merely
/// touched.
///
diff --git a/crates/exav-pe-emu/src/win.rs b/crates/exav-pe-emu/src/win.rs
index 4e68ee8..acb4935 100644
--- a/crates/exav-pe-emu/src/win.rs
+++ b/crates/exav-pe-emu/src/win.rs
@@ -60,15 +60,35 @@ const ENV_BASE: u32 = 0x0009_0000;
const HEAP_BASE: u32 = 0x0100_0000;
const HEAP_LIMIT: u32 = 0x6000_0000;
-/// Address space each synthetic DLL occupies. The first 0x4000 bytes hold the
-/// headers and export directory; the rest is the trap range its exports point
-/// into.
-const MODULE_SIZE: u32 = 0x0001_0000;
-const TRAP_OFFSET: u32 = 0x4000;
+/// Address space each synthetic DLL occupies. The headers and export directory
+/// live below `TRAP_OFFSET`; the trap range its exports point into runs from
+/// there. The region is large because a synthetic DLL advertises the real one's
+/// documented export names (over a thousand for `kernel32`), so a stub that
+/// resolves imports by hashing export names finds what it looks for.
+const MODULE_SIZE: u32 = 0x0004_0000;
+const TRAP_OFFSET: u32 = 0x0001_8000;
const TRAP_STRIDE: u32 = 0x10;
-/// Offset within `kernel32` that the emulator's two return sentinels sit at:
-/// past the trap range, still inside the module image.
-const RETURN_OFFSET: u32 = 0xc000;
+/// Offset within `kernel32` that the emulator's return sentinels sit at: past
+/// the trap range, still inside the module image.
+const RETURN_OFFSET: u32 = 0x0003_f000;
+
+/// Largest export directory, in bytes, a synthetic module may build below its
+/// trap range. Bounds the per-module name set so the directory cannot grow into
+/// the traps.
+const MAX_EXPORT_DIR: u32 = TRAP_OFFSET - 0x1000;
+
+/// The documented export-name set each synthetic system DLL advertises, beyond
+/// the handful the emulator implements. Names only, extracted from Microsoft's
+/// API documentation by `scripts/gen-exports.py` (provenance and licence in
+/// this crate's NOTICE). Undocumented exports are not in it. A name here with
+/// no implementation resolves to a trap that reports itself and returns
+/// failure, never to undefined behaviour.
+const EXTRA_EXPORTS: &[(&str, &str)] = &[
+ ("kernel32.dll", include_str!("exports/kernel32.txt")),
+ ("ntdll.dll", include_str!("exports/ntdll.txt")),
+ ("user32.dll", include_str!("exports/user32.txt")),
+ ("advapi32.dll", include_str!("exports/advapi32.txt")),
+];
/// Handle values with fixed meanings on Windows.
const INVALID_HANDLE: u32 = 0xffff_ffff;
@@ -162,6 +182,9 @@ enum Api {
WriteFile,
SetFilePointer,
GetFileSize,
+ GetFileAttributesEx {
+ wide: bool,
+ },
CreateFileMapping,
MapViewOfFile,
GetStdHandle,
@@ -484,6 +507,16 @@ const APIS: &[ApiSpec] = &[
k("CreateDirectoryW", 2, Api::Const(0)),
k("GetFileAttributesA", 1, Api::Const(0xffff_ffff)),
k("GetFileAttributesW", 1, Api::Const(0xffff_ffff)),
+ k(
+ "GetFileAttributesExA",
+ 3,
+ Api::GetFileAttributesEx { wide: false },
+ ),
+ k(
+ "GetFileAttributesExW",
+ 3,
+ Api::GetFileAttributesEx { wide: true },
+ ),
k("SetFileAttributesA", 2, Api::Const(0)),
k("CopyFileA", 3, Api::Const(0)),
k("MoveFileA", 2, Api::Const(0)),
@@ -846,6 +879,45 @@ impl<'a> Env<'a> {
self.kernel32_base() + RETURN_OFFSET + 0x10
}
+ /// Return address a TLS callback returns to, so the driver runs the next
+ /// one. A distinct sentinel from `process_return` because a callback
+ /// returning is not the stub returning to the loader.
+ pub fn tls_return(&self) -> u32 {
+ self.kernel32_base() + RETURN_OFFSET + 0x20
+ }
+
+ /// Set up the static TLS block the way the loader does before a TLS
+ /// callback runs: a copy of the module's TLS template (raw data plus zero
+ /// fill), the TEB's `ThreadLocalStoragePointer` pointing at a one-slot array
+ /// that holds it, and the assigned index written to `*index_va`.
+ ///
+ /// Returns the block's base, or `None` when the allocation does not fit.
+ pub fn install_static_tls(
+ &mut self,
+ mem: &mut Mem,
+ template: &[u8],
+ index: u32,
+ index_va: u32,
+ ) -> Result, Stop> {
+ let block = self.alloc(mem, 0, (template.len() as u32).max(1));
+ if block == 0 {
+ return Ok(None);
+ }
+ mem.write_bytes(block, template).map_err(Stop::Fault)?;
+ let array = self.alloc(mem, 0, (index + 1) * 4);
+ if array == 0 {
+ return Ok(None);
+ }
+ mem.write_u32(array + index * 4, block)
+ .map_err(Stop::Fault)?;
+ // TEB.ThreadLocalStoragePointer is at offset 0x2C on x86 [pe][dbg].
+ mem.write_u32(TEB_BASE + 0x2c, array).map_err(Stop::Fault)?;
+ if index_va != 0 {
+ mem.write_u32(index_va, index).map_err(Stop::Fault)?;
+ }
+ Ok(Some(block))
+ }
+
fn kernel32_base(&self) -> u32 {
self.find_module_by_name("kernel32.dll")
.map(|m| m.base)
@@ -861,18 +933,67 @@ impl<'a> Env<'a> {
self.modules.iter().find(|m| m.name == want)
}
- /// Create a synthetic DLL: PE headers, an export directory naming every API
- /// the emulator implements for it, and one trap address per export.
+ /// The sorted export set a synthetic module advertises: every API the
+ /// emulator implements for it, plus the real DLL's other documented export
+ /// names, bounded so the directory stays below the trap range.
+ ///
+ /// The list is sorted by name, because Windows keeps the export name table
+ /// sorted and hand-written resolvers binary-search it. Implemented exports
+ /// are never dropped by the size bound; only extra names are.
+ fn module_exports(&self, name: &str) -> Vec<(&'static str, Option, u8)> {
+ let mut implemented: Vec<(&'static str, Option, u8)> = APIS
+ .iter()
+ .filter(|s| s.module == name)
+ .map(|s| (s.name, Some(s.api), s.argc))
+ .collect();
+
+ // Running size of the export directory below RVA 0x1000: the three
+ // parallel arrays (10 bytes an entry) plus the name strings, plus the
+ // module's own name string. Kept under `MAX_EXPORT_DIR`.
+ let mut used = 40u32 + export_dir_name(name).len() as u32 + 1;
+ let entry_cost = |s: &str| 10 + s.len() as u32 + 1;
+ for (ename, ..) in &implemented {
+ used += entry_cost(ename);
+ }
+
+ if let Some((_, list)) = EXTRA_EXPORTS.iter().find(|(m, _)| *m == name) {
+ let known: std::collections::HashSet<&str> =
+ implemented.iter().map(|(n, ..)| *n).collect();
+ for ename in list.lines().map(str::trim).filter(|l| !l.is_empty()) {
+ if known.contains(ename) {
+ continue;
+ }
+ let cost = entry_cost(ename);
+ if used + cost > MAX_EXPORT_DIR {
+ break;
+ }
+ used += cost;
+ // A name this module exports but the emulator implements under
+ // another module (a forwarder) resolves to that implementation,
+ // as `export_addr` does by name across modules. Only a name no
+ // module implements becomes an unimplemented trap.
+ let spec = APIS.iter().find(|s| s.name == ename);
+ implemented.push((
+ ename,
+ spec.map(|s| s.api),
+ spec.map(|s| s.argc).unwrap_or(0),
+ ));
+ }
+ }
+ implemented.sort_by(|a, b| a.0.cmp(b.0));
+ implemented
+ }
+
+ /// Create a synthetic DLL: PE headers and an export directory. The directory
+ /// names every API the emulator implements for the module *and* the real
+ /// DLL's other documented exports (names only), so a stub that resolves imports by
+ /// hashing export names finds what it looks for. Each export points at a
+ /// trap; an unimplemented one's trap reports itself and returns failure when
+ /// called, never undefined behaviour.
fn create_module(&mut self, mem: &mut Mem, name: &str, base: u32) -> Result<(), Stop> {
map(mem, base, MODULE_SIZE)?;
let name = normalize_module(name);
- let exports: Vec<&ApiSpec> = {
- let mut v: Vec<&ApiSpec> = APIS.iter().filter(|s| s.module == name).collect();
- // Windows keeps the export name table sorted, and hand-written
- // resolvers binary-search it.
- v.sort_by_key(|s| s.name);
- v
- };
+ let exports = self.module_exports(&name);
let mut trap = base + TRAP_OFFSET;
// Export directory at RVA 0x1000, arrays and strings after it.
@@ -887,11 +1008,7 @@ impl<'a> Env<'a> {
ed.extend_from_slice(&0u32.to_le_bytes()); // Characteristics
ed.extend_from_slice(&0u32.to_le_bytes()); // TimeDateStamp
ed.extend_from_slice(&0u32.to_le_bytes()); // Major/Minor version
- ed.extend_from_slice(&strings_rva.to_le_bytes()); // Name (points at the
- // first string, which
- // is close enough for
- // a resolver that
- // only reads exports)
+ ed.extend_from_slice(&0u32.to_le_bytes()); // Name, patched below
ed.extend_from_slice(&1u32.to_le_bytes()); // Base ordinal
ed.extend_from_slice(&n.to_le_bytes()); // NumberOfFunctions
ed.extend_from_slice(&n.to_le_bytes()); // NumberOfNames
@@ -901,7 +1018,7 @@ impl<'a> Env<'a> {
mem.write_bytes(base + ed_rva, &ed).map_err(Stop::Fault)?;
let mut str_rva = strings_rva;
- for (i, spec) in exports.iter().enumerate() {
+ for (i, (ename, api, argc)) in exports.iter().enumerate() {
let i = i as u32;
mem.write_u32(base + funcs_rva + i * 4, trap - base)
.map_err(Stop::Fault)?;
@@ -909,19 +1026,27 @@ impl<'a> Env<'a> {
.map_err(Stop::Fault)?;
mem.write_u16(base + ords_rva + i * 2, i as u16)
.map_err(Stop::Fault)?;
- write_c_str(mem, base + str_rva, spec.name)?;
- str_rva += spec.name.len() as u32 + 1;
+ write_c_str(mem, base + str_rva, ename)?;
+ str_rva += ename.len() as u32 + 1;
self.traps.insert(
trap,
Trap {
- api: Some(spec.api),
- argc: spec.argc,
+ api: *api,
+ argc: *argc,
module: name.clone(),
- name: spec.name.to_string(),
+ name: ename.to_string(),
},
);
trap += TRAP_STRIDE;
}
+ // The DLL's own name, spelled as the real export directory spells it.
+ // tElock reads it to check that the module it found is `KERNEL32` and
+ // spins forever when it is not.
+ let export_name = export_dir_name(&name);
+ write_c_str(mem, base + str_rva, &export_name)?;
+ mem.write_u32(base + ed_rva + 12, str_rva)
+ .map_err(Stop::Fault)?;
+ str_rva += export_name.len() as u32 + 1;
write_module_headers(mem, base, MODULE_SIZE, ed_rva, str_rva - ed_rva)?;
self.modules.push(Module {
@@ -933,23 +1058,34 @@ impl<'a> Env<'a> {
Ok(())
}
+ // Where each layout fact below comes from (pinned sources in the NOTICE):
+ // [pe] Microsoft PE Format specification, "The .tls Section".
+ // [dbg] Microsoft debugger documentation: `dt` output on 32-bit Windows.
+ // [wtl] Microsoft winternl.h reference; x86 offsets follow from the
+ // documented member types.
+ // [kus] Microsoft WDK reference for KUSER_SHARED_DATA, which gives the
+ // field order but not every type, so not the offsets.
+ // [obs] Not given by those sources. Each is observable on 32-bit Windows
+ // by comparing the field with the API that reports the same value
+ // (listed in the NOTICE); kept on that basis.
+
/// Fill `KUSER_SHARED_DATA` with the handful of fields a stub reads: the
/// interrupt/tick counters (used for timing checks) and the OS version.
fn build_shared_user_data(&self, mem: &mut Mem) -> Result<(), Stop> {
map(mem, SHARED_USER_DATA, PAGE_SIZE as u32)?;
mem.write_u32(SHARED_USER_DATA, 0x0010_0000)
- .map_err(Stop::Fault)?; // TickCountLow
+ .map_err(Stop::Fault)?; // TickCountLowDeprecated [kus][obs]
mem.write_u32(SHARED_USER_DATA + 0x04, 0x000f_a000)
- .map_err(Stop::Fault)?; // TickCountMultiplier
+ .map_err(Stop::Fault)?; // TickCountMultiplier [kus][obs]
mem.write_u32(SHARED_USER_DATA + 0x08, 0x0010_0000)
- .map_err(Stop::Fault)?; // InterruptTime.LowPart
+ .map_err(Stop::Fault)?; // InterruptTime, low part [kus][obs]
mem.write_u32(SHARED_USER_DATA + 0x14, 0x1000_0000)
- .map_err(Stop::Fault)?; // SystemTime.LowPart
- write_utf16(mem, SHARED_USER_DATA + 0x30, "C:\\WINDOWS")?; // NtSystemRoot
+ .map_err(Stop::Fault)?; // SystemTime, low part [kus][obs]
+ write_utf16(mem, SHARED_USER_DATA + 0x30, "C:\\WINDOWS")?; // NtSystemRoot [kus][obs]
mem.write_u32(SHARED_USER_DATA + 0x26c, 5)
- .map_err(Stop::Fault)?; // NtMajorVersion
+ .map_err(Stop::Fault)?; // NtMajorVersion [kus][obs]
mem.write_u32(SHARED_USER_DATA + 0x270, 1)
- .map_err(Stop::Fault)?; // NtMinorVersion
+ .map_err(Stop::Fault)?; // NtMinorVersion [kus][obs]
Ok(())
}
@@ -963,35 +1099,36 @@ impl<'a> Env<'a> {
map(mem, TEB_BASE, PAGE_SIZE as u32)?;
map(mem, PEB_BASE, PAGE_SIZE as u32)?;
- // TEB.
- mem.write_u32(TEB_BASE, 0xffff_ffff).map_err(Stop::Fault)?; // ExceptionList: chain end
+ // TEB. NtTib (an NT_TIB) is at 0x00 [dbg]; its members' order is
+ // consistent with the [dbg] `dd` example, and is [obs].
+ mem.write_u32(TEB_BASE, 0xffff_ffff).map_err(Stop::Fault)?; // NtTib.ExceptionList: chain end [obs]
mem.write_u32(TEB_BASE + 0x04, STACK_TOP)
- .map_err(Stop::Fault)?; // StackBase
+ .map_err(Stop::Fault)?; // NtTib.StackBase [obs]
mem.write_u32(TEB_BASE + 0x08, STACK_BASE)
- .map_err(Stop::Fault)?; // StackLimit
+ .map_err(Stop::Fault)?; // NtTib.StackLimit [obs]
mem.write_u32(TEB_BASE + 0x18, TEB_BASE)
- .map_err(Stop::Fault)?; // Self
+ .map_err(Stop::Fault)?; // NtTib.Self [obs]
mem.write_u32(TEB_BASE + 0x20, 0x0000_0abc)
- .map_err(Stop::Fault)?; // ProcessId
+ .map_err(Stop::Fault)?; // ClientId.UniqueProcess: ClientId at 0x20 [dbg], member order [obs]
mem.write_u32(TEB_BASE + 0x24, 0x0000_0def)
- .map_err(Stop::Fault)?; // ThreadId
+ .map_err(Stop::Fault)?; // ClientId.UniqueThread [obs]
mem.write_u32(TEB_BASE + 0x30, PEB_BASE)
- .map_err(Stop::Fault)?; // PEB
+ .map_err(Stop::Fault)?; // ProcessEnvironmentBlock [dbg]
// PEB. `BeingDebugged` and `NtGlobalFlag` are the two fields anti-debug
// stubs read directly, and both say "no debugger".
mem.write_u32(PEB_BASE + 0x08, image_base)
- .map_err(Stop::Fault)?; // ImageBaseAddress
+ .map_err(Stop::Fault)?; // ImageBaseAddress [obs]
mem.write_u32(PEB_BASE + 0x0c, LDR_BASE)
- .map_err(Stop::Fault)?; // Ldr
+ .map_err(Stop::Fault)?; // Ldr [dbg]
mem.write_u32(PEB_BASE + 0x18, PROCESS_HEAP)
- .map_err(Stop::Fault)?; // ProcessHeap
- mem.write_u32(PEB_BASE + 0x64, 1).map_err(Stop::Fault)?; // NumberOfProcessors
- mem.write_u32(PEB_BASE + 0x68, 0).map_err(Stop::Fault)?; // NtGlobalFlag
- mem.write_u32(PEB_BASE + 0xa4, 5).map_err(Stop::Fault)?; // OSMajorVersion
- mem.write_u32(PEB_BASE + 0xa8, 1).map_err(Stop::Fault)?; // OSMinorVersion
- mem.write_u32(PEB_BASE + 0xac, 2600).map_err(Stop::Fault)?; // OSBuildNumber
- mem.write_u32(PEB_BASE + 0xb0, 2).map_err(Stop::Fault)?; // PlatformId
+ .map_err(Stop::Fault)?; // ProcessHeap [obs]
+ mem.write_u32(PEB_BASE + 0x64, 1).map_err(Stop::Fault)?; // NumberOfProcessors [obs]
+ mem.write_u32(PEB_BASE + 0x68, 0).map_err(Stop::Fault)?; // NtGlobalFlag [obs]
+ mem.write_u32(PEB_BASE + 0xa4, 5).map_err(Stop::Fault)?; // OSMajorVersion [obs]
+ mem.write_u32(PEB_BASE + 0xa8, 1).map_err(Stop::Fault)?; // OSMinorVersion [obs]
+ mem.write_u32(PEB_BASE + 0xac, 2600).map_err(Stop::Fault)?; // OSBuildNumber [obs]
+ mem.write_u32(PEB_BASE + 0xb0, 2).map_err(Stop::Fault)?; // OSPlatformId [obs]
// PEB_LDR_DATA followed by one LDR_DATA_TABLE_ENTRY per module. The
// executable itself comes first in load and memory order, but not in
@@ -1027,8 +1164,10 @@ impl<'a> Env<'a> {
let mem_head = ldr + 0x14;
let init_head = ldr + 0x1c;
- mem.write_u32(ldr, 0x28).map_err(Stop::Fault)?; // Length
- mem.write_u32(ldr + 4, 1).map_err(Stop::Fault)?; // Initialized
+ // PEB_LDR_DATA: Length (0x28), Initialized, and the three list heads at
+ // 0x0c / 0x14 / 0x1c [dbg].
+ mem.write_u32(ldr, 0x28).map_err(Stop::Fault)?; // Length [dbg]
+ mem.write_u32(ldr + 4, 1).map_err(Stop::Fault)?; // Initialized [dbg]
let init_idx: Vec = (0..list.len()).filter(|&i| list[i].in_init).collect();
let all_idx: Vec = (0..list.len()).collect();
@@ -1053,17 +1192,23 @@ impl<'a> Env<'a> {
mem.write_u32(head + 4, last).map_err(Stop::Fault)?;
Ok(())
};
+ // LDR_DATA_TABLE_ENTRY links. InMemoryOrderLinks at 0x08 [wtl]. The
+ // load-order links at 0x00 follow from the [dbg] example, where the two
+ // lists' heads point 8 bytes apart into the same entry. The
+ // initialisation-order links fill the documented reserved slot at 0x10
+ // [wtl], their meaning [obs].
link(mem, load_head, 0x00, &all_idx)?;
link(mem, mem_head, 0x08, &all_idx)?;
link(mem, init_head, 0x10, &init_idx)?;
for (i, l) in list.iter().enumerate() {
let e = addr_of(i);
- mem.write_u32(e + 0x18, l.base).map_err(Stop::Fault)?; // DllBase
- mem.write_u32(e + 0x1c, l.base).map_err(Stop::Fault)?; // EntryPoint
- mem.write_u32(e + 0x20, l.size).map_err(Stop::Fault)?; // SizeOfImage
- // FullDllName / BaseDllName as UNICODE_STRINGs pointing into the
- // string area after the entries.
+ mem.write_u32(e + 0x18, l.base).map_err(Stop::Fault)?; // DllBase [wtl]
+ mem.write_u32(e + 0x1c, l.base).map_err(Stop::Fault)?; // EntryPoint: reserved slot [wtl], meaning [obs]
+ mem.write_u32(e + 0x20, l.size).map_err(Stop::Fault)?; // SizeOfImage: reserved slot [wtl], meaning [obs]
+ // FullDllName at 0x24 [wtl] and BaseDllName at 0x2c (reserved slot
+ // [wtl], meaning [obs]), as UNICODE_STRINGs into the string area
+ // after the entries.
let str_addr = entry0 + list.len() as u32 * ENTRY_SIZE + i as u32 * 0x80;
let wide: Vec = l
.name
@@ -1518,6 +1663,28 @@ impl<'a> Env<'a> {
}
self.file.len() as u32
}
+ Api::GetFileAttributesEx { wide } => {
+ // The program's own file exists and reports a size; every other
+ // path is absent, as with `CreateFile`. A stub that stats itself
+ // before unpacking (Alienyze does) needs the success answer, not
+ // the "file not found" that stops it.
+ let p = arg(cpu, mem, 0)?;
+ let path = read_str(mem, p, wide)?;
+ let out = arg(cpu, mem, 2)?;
+ if self.is_own_path(&path) && out != 0 {
+ // WIN32_FILE_ATTRIBUTE_DATA: attributes, three FILETIMEs,
+ // then the 64-bit size. Only the attributes and size carry
+ // information a stub acts on.
+ let mut data = [0u8; 0x24];
+ data[0..4].copy_from_slice(&0x80u32.to_le_bytes()); // FILE_ATTRIBUTE_NORMAL
+ data[0x20..0x24].copy_from_slice(&(self.file.len() as u32).to_le_bytes());
+ mem.write_bytes(out, &data).map_err(Stop::Fault)?;
+ 1
+ } else {
+ self.last_error = 2; // ERROR_FILE_NOT_FOUND
+ 0
+ }
+ }
Api::CreateFileMapping => {
let h = arg(cpu, mem, 0)?;
if self.open_files.contains_key(&h) {
@@ -1930,6 +2097,18 @@ fn normalize_module(name: &str) -> String {
}
}
+/// The name a DLL's export directory gives itself: `KERNEL32.dll`, `ntdll.dll`.
+/// Most system DLLs spell the stem in capitals; `ntdll` and `msvcrt` do not.
+fn export_dir_name(normalized: &str) -> String {
+ if matches!(normalized, "ntdll.dll" | "msvcrt.dll") {
+ return normalized.to_string();
+ }
+ match normalized.rsplit_once('.') {
+ Some((stem, ext)) => format!("{}.{ext}", stem.to_ascii_uppercase()),
+ None => normalized.to_ascii_uppercase(),
+ }
+}
+
fn write_utf16(mem: &mut Mem, addr: u32, s: &str) -> Result<(), Stop> {
let b: Vec = s
.encode_utf16()
@@ -2092,6 +2271,23 @@ mod tests {
);
}
+ #[test]
+ fn a_synthetic_dll_names_itself_as_the_real_one_does() {
+ // The export directory's Name field is `KERNEL32.dll`, not the lower-
+ // case internal name. A stub that walks the loader list and checks the
+ // export name (tElock does, and spins when it does not match) has to see
+ // what a real module shows.
+ let (mut mem, _env) = env();
+ for (base, want) in [(0x7c80_0000u32, "KERNEL32.dll"), (0x7c90_0000, "ntdll.dll")] {
+ let e_lfanew = mem.read_u32(base + 0x3c).unwrap();
+ let dd = base + e_lfanew + 24 + 96;
+ let ed = base + mem.read_u32(dd).unwrap();
+ let name_va = base + mem.read_u32(ed + 12).unwrap();
+ let name = read_str(&mut mem, name_va, false).unwrap();
+ assert_eq!(name, want);
+ }
+ }
+
/// A block copy reports the volume it moved, so the driver can charge for it.
///
/// The tick budget bounds instructions executed, which stands in for work
@@ -2264,6 +2460,84 @@ mod tests {
assert!(env.is_trap(cpu.regs[EAX]));
}
+ #[test]
+ fn the_export_directory_advertises_the_real_dll_names_not_just_implemented() {
+ // A stub that resolves imports by hashing export names walks the name
+ // table itself. The synthetic kernel32 therefore advertises the real
+ // DLL's exports, not only the handful the emulator implements, so such a
+ // walk finds its function. Alienyze fails exactly this way otherwise.
+ let (mut mem, mut env) = env();
+ let base = 0x7c80_0000u32;
+ let e_lfanew = mem.read_u32(base + 0x3c).unwrap();
+ let ed = base + mem.read_u32(base + e_lfanew + 24 + 96).unwrap();
+ let n_names = mem.read_u32(ed + 24).unwrap();
+ let names = base + mem.read_u32(ed + 32).unwrap();
+ let funcs = base + mem.read_u32(ed + 28).unwrap();
+ // `GetVolumeInformationA` is a real kernel32 export the emulator does not
+ // implement. It must still be in the directory, and resolve to a trap.
+ let mut found = None;
+ for i in 0..n_names {
+ let p = base + mem.read_u32(names + i * 4).unwrap();
+ if read_str(&mut mem, p, false).unwrap() == "GetVolumeInformationA" {
+ found = Some(base + mem.read_u32(funcs + i * 4).unwrap());
+ }
+ }
+ let addr = found.expect("an unimplemented real export is still advertised");
+ assert!(
+ env.is_trap(addr),
+ "it resolves to a trap the driver services"
+ );
+
+ // Calling it is safe and observable: it returns failure and is recorded,
+ // never undefined behaviour.
+ let mut cpu = Cpu::new();
+ cpu.regs[ESP] = INITIAL_ESP;
+ cpu.push32(&mut mem, 0xdead_0000).unwrap(); // return address
+ cpu.eip = addr;
+ let effect = env.call(&mut cpu, &mut mem).unwrap();
+ assert_eq!(effect, ApiEffect::Unimplemented);
+ assert_eq!(cpu.regs[EAX], 0);
+ assert!(env
+ .missing_apis
+ .iter()
+ .any(|m| m.ends_with("GetVolumeInformationA")));
+ }
+
+ #[test]
+ fn get_file_attributes_ex_reports_the_program_exists_with_its_size() {
+ // The program's own file exists and reports its size; a stub that stats
+ // itself before unpacking (Alienyze does) needs the success answer, not
+ // the "not found" that stops it. Every other path is absent.
+ let mut mem = Mem::new(4096);
+ mem.map(0x0040_0000, 0x1000).unwrap();
+ let file: &[u8] = &vec![0u8; 0x1234];
+ let mut env = Env::new(&mut mem, 0x0040_0000, 0x1_0000, file).unwrap();
+
+ let name = 0x0050_0000u32;
+ let out = 0x0051_0000u32;
+ mem.map(name, 0x1000).unwrap();
+ mem.map(out, 0x1000).unwrap();
+ mem.write_bytes(name, b"C:\\sample.exe\0").unwrap();
+ // GetFileAttributesExA(lpFileName, GetFileExInfoStandard, out).
+ assert_eq!(
+ call_k32(&mut env, &mut mem, "GetFileAttributesExA", &[name, 0, out]),
+ 1
+ );
+ assert_eq!(mem.read_u32(out).unwrap(), 0x80, "FILE_ATTRIBUTE_NORMAL");
+ assert_eq!(
+ mem.read_u32(out + 0x20).unwrap(),
+ 0x1234,
+ "nFileSizeLow is the file length"
+ );
+
+ mem.write_bytes(name, b"C:\\other.exe\0").unwrap();
+ assert_eq!(
+ call_k32(&mut env, &mut mem, "GetFileAttributesExA", &[name, 0, out]),
+ 0,
+ "a path that is not the program does not exist"
+ );
+ }
+
#[test]
fn loadlibrary_of_an_unknown_dll_creates_a_module() {
let (mut mem, mut env) = env();
diff --git a/crates/exav-pe-emu/tests/end_to_end.rs b/crates/exav-pe-emu/tests/end_to_end.rs
new file mode 100644
index 0000000..79fdcd9
--- /dev/null
+++ b/crates/exav-pe-emu/tests/end_to_end.rs
@@ -0,0 +1,249 @@
+//! End-to-end tests a consumer of the crate can run: build a PE in memory, run
+//! its stub through [`exav_pe_emu::unpack`], and check the image that comes out.
+//!
+//! The fixtures are assembled here rather than committed as binaries, so nothing
+//! third-party or packed is checked in. [`pe`] is the generator: a minimal but
+//! real PE32 with the sections, entry point and (optionally) TLS directory each
+//! test needs.
+
+use exav_pe_emu::{unpack, EmuLimits};
+
+/// A minimal PE32 builder. The image has two sections, `.text` (the empty
+/// destination a stub fills) at RVA 0x1000 and `.pack` (the stub's own bytes)
+/// at RVA 0x2000, mapped at base 0x400000. The caller supplies `.pack`'s raw
+/// bytes, the entry RVA, and an optional TLS directory RVA.
+mod pe {
+ pub const BASE: u32 = 0x0040_0000;
+ pub const TEXT_RVA: u32 = 0x1000;
+ pub const PACK_RVA: u32 = 0x2000;
+
+ pub struct Pe {
+ pub entry_rva: u32,
+ pub pack: Vec,
+ pub tls_dir_rva: Option,
+ }
+
+ impl Pe {
+ pub fn build(&self) -> Vec {
+ let pe_off = 0x80usize;
+ let opt_size = 0xe0usize;
+ let sec_table = pe_off + 24 + opt_size;
+ let num = 2usize;
+ let headers = 0x400usize;
+ let pack_raw = headers;
+ let pack_len = self.pack.len().max(0x200);
+ let mut d = vec![0u8; pack_raw + pack_len];
+
+ d[..2].copy_from_slice(b"MZ");
+ d[0x3c..0x40].copy_from_slice(&(pe_off as u32).to_le_bytes());
+ d[pe_off..pe_off + 4].copy_from_slice(b"PE\0\0");
+ let coff = pe_off + 4;
+ d[coff..coff + 2].copy_from_slice(&0x14cu16.to_le_bytes()); // i386
+ d[coff + 2..coff + 4].copy_from_slice(&(num as u16).to_le_bytes());
+ d[coff + 16..coff + 18].copy_from_slice(&(opt_size as u16).to_le_bytes());
+
+ let opt = coff + 20;
+ d[opt..opt + 2].copy_from_slice(&0x10bu16.to_le_bytes()); // PE32
+ d[opt + 16..opt + 20].copy_from_slice(&self.entry_rva.to_le_bytes());
+ d[opt + 28..opt + 32].copy_from_slice(&BASE.to_le_bytes());
+ d[opt + 32..opt + 36].copy_from_slice(&0x1000u32.to_le_bytes()); // SectionAlignment
+ d[opt + 36..opt + 40].copy_from_slice(&0x200u32.to_le_bytes()); // FileAlignment
+ d[opt + 56..opt + 60].copy_from_slice(&0x3000u32.to_le_bytes()); // SizeOfImage
+ d[opt + 60..opt + 64].copy_from_slice(&0x400u32.to_le_bytes()); // SizeOfHeaders
+ // 16 data directories, so the TLS slot (9) is present.
+ d[opt + 92..opt + 96].copy_from_slice(&16u32.to_le_bytes());
+ if let Some(tls_rva) = self.tls_dir_rva {
+ let dd = opt + 96 + 9 * 8; // data directory 9
+ d[dd..dd + 4].copy_from_slice(&tls_rva.to_le_bytes());
+ d[dd + 4..dd + 8].copy_from_slice(&0x18u32.to_le_bytes());
+ }
+
+ // Section 0: `.text`, the empty destination (no raw data).
+ let s0 = sec_table;
+ d[s0..s0 + 5].copy_from_slice(b".text");
+ d[s0 + 8..s0 + 12].copy_from_slice(&0x1000u32.to_le_bytes()); // VirtualSize
+ d[s0 + 12..s0 + 16].copy_from_slice(&TEXT_RVA.to_le_bytes());
+ d[s0 + 36..s0 + 40].copy_from_slice(&0xe000_0020u32.to_le_bytes());
+
+ // Section 1: `.pack`, holding the stub.
+ let s1 = sec_table + 40;
+ d[s1..s1 + 5].copy_from_slice(b".pack");
+ d[s1 + 8..s1 + 12].copy_from_slice(&0x1000u32.to_le_bytes());
+ d[s1 + 12..s1 + 16].copy_from_slice(&PACK_RVA.to_le_bytes());
+ d[s1 + 16..s1 + 20].copy_from_slice(&(self.pack.len() as u32).to_le_bytes());
+ d[s1 + 20..s1 + 24].copy_from_slice(&(pack_raw as u32).to_le_bytes());
+ d[s1 + 36..s1 + 40].copy_from_slice(&0xe000_0020u32.to_le_bytes());
+
+ d[pack_raw..pack_raw + self.pack.len()].copy_from_slice(&self.pack);
+ d
+ }
+ }
+
+ /// `.text`'s raw offset inside a dump, so a test can read the bytes a stub
+ /// wrote there. A memory-layout dump puts `PointerToRawData == VirtualAddress`.
+ pub fn text_offset_in_dump(dump: &[u8]) -> usize {
+ let pe = u32::from_le_bytes(dump[0x3c..0x40].try_into().unwrap()) as usize;
+ let opt = pe + 24;
+ let sec = opt + u16::from_le_bytes(dump[pe + 20..pe + 22].try_into().unwrap()) as usize;
+ u32::from_le_bytes(dump[sec + 20..sec + 24].try_into().unwrap()) as usize
+ }
+}
+
+/// Limits with the dirty-byte floors dropped, because these hand-written stubs
+/// rebuild a page, not the tens of kilobytes a real unpack produces.
+fn limits() -> EmuLimits {
+ EmuLimits {
+ min_unpack_dirty: 0,
+ min_partial_dirty: 0,
+ ..Default::default()
+ }
+}
+
+#[test]
+fn a_decrypt_and_jump_stub_unpacks() {
+ // The archetype: XOR-decrypt a body from `.pack` into `.text`, then jump to
+ // it. Mirrors a runtime packer's tail transfer.
+ let plain: &[u8] = b"ORIGINAL PROGRAM";
+ let cipher: Vec = plain.iter().map(|b| b ^ 0x5a).collect();
+
+ // src = PACK_RVA + 0x40 (the cipher text, below the stub).
+ let src = pe::BASE + pe::PACK_RVA + 0x40;
+ let dst = pe::BASE + pe::TEXT_RVA;
+ let mut stub = vec![
+ 0xbe, 0, 0, 0, 0, // mov esi, src
+ 0xbf, 0, 0, 0, 0, // mov edi, dst
+ 0xb9, 0, 0, 0, 0, // mov ecx, len
+ 0xac, 0x34, 0x5a, 0xaa, 0xe2, 0xfa, // lodsb; xor al,0x5a; stosb; loop -6
+ ];
+ stub[1..5].copy_from_slice(&src.to_le_bytes());
+ stub[6..10].copy_from_slice(&dst.to_le_bytes());
+ stub[11..15].copy_from_slice(&(plain.len() as u32).to_le_bytes());
+ // jmp dst (rel32 from the end of this instruction).
+ let jmp_at = pe::BASE + pe::PACK_RVA + stub.len() as u32;
+ let rel = dst.wrapping_sub(jmp_at + 5) as i32;
+ stub.push(0xe9);
+ stub.extend_from_slice(&rel.to_le_bytes());
+
+ let mut pack = vec![0u8; 0x40];
+ pack[..stub.len()].copy_from_slice(&stub);
+ pack.extend_from_slice(&cipher);
+
+ let file = pe::Pe {
+ entry_rva: pe::PACK_RVA,
+ pack,
+ tls_dir_rva: None,
+ }
+ .build();
+
+ let r = unpack(&file, &limits());
+ let u = r.unpacked.expect("an image was reconstructed");
+ assert!(u.reached_oep, "stopped at the tail jump: {}", r.stop);
+ assert_eq!(u.oep_rva, pe::TEXT_RVA);
+ let at = pe::text_offset_in_dump(&u.data);
+ assert_eq!(&u.data[at..at + plain.len()], plain);
+}
+
+#[test]
+fn a_stub_that_writes_nothing_yields_no_image() {
+ // `ret`: a stub that does nothing produces no reconstruction, and the crate
+ // reports that rather than handing back the input under an "unpacked" name.
+ let file = pe::Pe {
+ entry_rva: pe::PACK_RVA,
+ pack: vec![0xc3],
+ tls_dir_rva: None,
+ }
+ .build();
+ let r = unpack(&file, &limits());
+ assert!(r.unpacked.is_none(), "{}", r.stop);
+ assert_eq!(r.dirty_bytes, 0);
+}
+
+/// Build the TLS fixture: a file whose entry point only jumps into `.text`,
+/// which is empty until a TLS callback copies the payload there. Reaching the
+/// original entry point therefore proves the callback ran before the entry
+/// point, as the Windows loader runs it.
+fn tls_fixture() -> Vec {
+ let payload: &[u8] = b"OEP-CODE-PLACED-BY-TLS-CALLBACK";
+
+ // Layout inside `.pack` (RVA 0x2000):
+ // 0x00 entry: jmp .text (nothing of its own to unpack)
+ // 0x10 callback: rep movsb payload -> .text; ret
+ // 0x60 payload bytes
+ // 0xA0 callback array: [callback_va, 0]
+ // 0xC0 TLS directory (IMAGE_TLS_DIRECTORY32)
+ // 0xE0 AddressOfIndex storage
+ let entry_off = 0x00u32;
+ let cb_off = 0x10u32;
+ let payload_off = 0x60u32;
+ let cb_array_off = 0xa0u32;
+ let tls_dir_off = 0xc0u32;
+ let index_off = 0xe0u32;
+ let va = |off: u32| pe::BASE + pe::PACK_RVA + off;
+ let dst = pe::BASE + pe::TEXT_RVA;
+
+ let mut pack = vec![0u8; 0x100];
+
+ // entry: jmp .text
+ let rel = dst.wrapping_sub(va(entry_off) + 5) as i32;
+ pack[entry_off as usize] = 0xe9;
+ pack[entry_off as usize + 1..entry_off as usize + 5].copy_from_slice(&rel.to_le_bytes());
+
+ // callback(image_base, reason, reserved): copy the payload into .text, ret.
+ let cb = [
+ vec![0xbf],
+ dst.to_le_bytes().to_vec(), // mov edi, .text
+ vec![0xbe],
+ va(payload_off).to_le_bytes().to_vec(), // mov esi, payload
+ vec![0xb9],
+ (payload.len() as u32).to_le_bytes().to_vec(), // mov ecx, len
+ vec![0xf3, 0xa4], // rep movsb
+ vec![0xc3], // ret
+ ]
+ .concat();
+ pack[cb_off as usize..cb_off as usize + cb.len()].copy_from_slice(&cb);
+
+ pack[payload_off as usize..payload_off as usize + payload.len()].copy_from_slice(payload);
+
+ // Callback array: one callback, null-terminated.
+ pack[cb_array_off as usize..cb_array_off as usize + 4]
+ .copy_from_slice(&va(cb_off).to_le_bytes());
+
+ // IMAGE_TLS_DIRECTORY32: no raw data, AddressOfIndex -> our storage,
+ // AddressOfCallBacks -> the array.
+ let td = tls_dir_off as usize;
+ pack[td + 8..td + 12].copy_from_slice(&va(index_off).to_le_bytes()); // AddressOfIndex
+ pack[td + 12..td + 16].copy_from_slice(&va(cb_array_off).to_le_bytes()); // AddressOfCallBacks
+
+ let _ = index_off;
+ pe::Pe {
+ entry_rva: pe::PACK_RVA,
+ pack,
+ tls_dir_rva: Some(pe::PACK_RVA + tls_dir_off),
+ }
+ .build()
+}
+
+#[test]
+fn a_tls_callback_runs_before_the_entry_point() {
+ // PE-1 coverage. The entry point only jumps into `.text`; `.text` holds the
+ // original code only because the TLS callback put it there first. If the
+ // callback did not run, `.text` is empty and nothing is recovered.
+ let payload: &[u8] = b"OEP-CODE-PLACED-BY-TLS-CALLBACK";
+ let file = tls_fixture();
+ let r = unpack(&file, &limits());
+ let u = r
+ .unpacked
+ .expect("the TLS callback filled .text and the entry point reached it");
+ assert!(
+ u.reached_oep,
+ "did not reach the original entry point: {}",
+ r.stop
+ );
+ assert_eq!(u.oep_rva, pe::TEXT_RVA);
+ let at = pe::text_offset_in_dump(&u.data);
+ assert_eq!(
+ &u.data[at..at + payload.len()],
+ payload,
+ "the dump holds the code the TLS callback wrote"
+ );
+}
diff --git a/crates/exav-render/Cargo.toml b/crates/exav-render/Cargo.toml
index 7c574e9..ad3cf5a 100644
--- a/crates/exav-render/Cargo.toml
+++ b/crates/exav-render/Cargo.toml
@@ -1,17 +1,17 @@
[package]
name = "exav-render"
-description = "Memory-safe decoders that turn files into something to draw: images into pixels, DWG and DXF drawings and IFC and STL models into GPU-ready geometry."
+description = "Memory-safe decoders that turn files into something to draw: images into pixels, DWG and DXF drawings and IFC, STL, OBJ, PLY and glTF models into GPU-ready geometry, and office documents (spreadsheets, presentations, text documents) into XLSX, PPTX and DOCX."
version.workspace = true
edition.workspace = true
license.workspace = true
rust-version.workspace = true
repository.workspace = true
homepage.workspace = true
-keywords = ["image", "dwg", "ifc", "decoder", "cad"]
+keywords = ["image", "dwg", "ifc", "office", "cad"]
categories = ["multimedia::images", "rendering::data-formats"]
readme = "README.md"
-# The stroke font the build script compiles in, and its licence.
-include = ["src/**/*", "fonts/**/*", "build.rs", "README.md", "LICENSE"]
+# The stroke font the build script compiles in, and the licences and notices.
+include = ["src/**/*", "fonts/**/*", "build.rs", "README.md", "LICENSE", "NOTICE"]
# The vendored `tiff` decoder's doc examples are written for it as a crate of
# its own: here their `use tiff::...` cannot resolve.
@@ -31,12 +31,11 @@ gif = { version = "=0.14.1", optional = true }
zune-jpeg = { version = "=0.5.8", default-features = false, features = ["std"], optional = true }
zune-core = { version = "=0.5.0", optional = true }
zune-core-04 = { package = "zune-core", version = "=0.4.12", optional = true }
-# The vendored `tiff` decoder's dependencies, as tiff 0.10.3 has them, and
-# `bytemuck` for its byte casts.
+# The vendored `tiff` decoder's dependencies, as tiff 0.10.3 has them less
+# `half`, and `bytemuck` for its byte casts.
zune-jpeg-04 = { package = "zune-jpeg", version = "=0.4.21", default-features = false, features = ["std"], optional = true }
fax34 = { package = "fax", version = "=0.2.6", optional = true }
-flate2 = { version = "1.0.20", optional = true }
-half = { version = "2.4.1", optional = true }
+flate2 = { version = "1.1.10", optional = true }
quick-error = { version = "2.0.1", optional = true }
# Also `gif`'s LZW. 0.1.12, not libclamav's 0.1.10: it only corrects a debug
# assertion that a TIFF stream without a clear code tripped; it decodes the same.
@@ -49,17 +48,37 @@ bytemuck = { version = "1", optional = true }
hayro-jpeg2000 = { version = "=0.4.1", default-features = false, features = ["std"], optional = true }
hayro-jbig2 = { version = "=0.3.1", default-features = false, features = ["std"], optional = true }
hayro-ccitt = { version = "=0.4.0", optional = true }
+# JPEG XL: zenjxl-decoder, a fork of the libjxl team's jxl-rs that is
+# `#![forbid(unsafe_code)]` unless its `allow-unsafe` feature is on, with
+# limits on pixels and memory. Built without its SIMD (the default
+# `all-simd`) and without `threads`; no CMS, no JPEG reconstruction.
+zenjxl-decoder = { version = "=0.3.10", default-features = false, optional = true }
# DXF's pairs, records and code pages, and DWG's bit codes, sections and
# objects, which the drawing model (`cad`) is read from; those formats
# alone, none of the scanner's others.
exav-unpack = { path = "../exav-unpack", version = "0.0.2", default-features = false, features = ["dxf", "dwg"], optional = true }
+# Markdown: CommonMark with tables and strikethrough, read as events. Without
+# its `html` and `simd` features: no markup is made, and its only `unsafe`
+# (the SIMD scanners) is off.
+pulldown-cmark = { version = "=0.13.4", default-features = false, optional = true }
+# The office converters (`office-*`): packages are read, and the XLSX, PPTX
+# and DOCX written, as ZIP.
+zip = { version = "9", default-features = false, features = ["deflate-flate2"], optional = true }
+# ODF's XML. 0.41 bounds namespace declarations per element and checks
+# duplicate attributes in linear time (RUSTSEC-2026-0194, -0195).
+quick-xml = { version = "0.42", optional = true }
+# Text in Windows and Mac code pages; the DOS ones are tables of our own.
+encoding_rs = { version = "0.8.42", default-features = false, features = ["alloc"], optional = true }
+# XLS decryption with the default password ([MS-OFFCRYPTO] RC4, RC4 CryptoAPI).
+md-5 = { version = "0.11", optional = true }
+sha1 = { version = "0.11", optional = true }
[features]
-default = ["image", "webp", "ico", "pnm", "qoi", "dds", "ff", "hdr", "jp2", "jbig2", "ccitt"]
+default = ["image", "webp", "ico", "pnm", "qoi", "dds", "ff", "hdr", "jp2", "jbig2", "ccitt", "raw"]
# Raster images: PNG, GIF, JPEG, TIFF and BMP, plus the formats below.
image = [
"dep:image", "dep:png", "dep:gif", "dep:zune-jpeg", "dep:zune-core", "dep:zune-core-04",
- "dep:zune-jpeg-04", "dep:fax34", "dep:flate2", "dep:half", "dep:quick-error", "dep:weezl",
+ "dep:zune-jpeg-04", "dep:fax34", "dep:flate2", "dep:quick-error", "dep:weezl",
"dep:bytemuck",
]
# Each is a decoder without `unsafe`: image-webp and qoi are
@@ -80,6 +99,14 @@ jp2 = ["dep:hayro-jpeg2000"]
jbig2 = ["dep:hayro-jbig2"]
# A PDF's CCITTFaxDecode streams (`pdf_image`).
ccitt = ["dep:hayro-ccitt"]
+# Camera RAW files (DNG, CR2, CR3, NEF, ARW, ORF, RW2, RAF, PEF, SRW, 3FR,
+# IIQ, X3F...), shown by the largest JPEG or RGB preview they embed
+# (`image::raw`). The sensor data is not decoded.
+raw = ["image"]
+# JPEG XL, first frame, as 8-bit grey or RGBA. Not a default: libclamav does
+# not decode it, so the scanner's image hash has no use for it, and it is the
+# largest decoder here.
+jxl = ["image", "dep:zenjxl-decoder"]
# DXF (R12 to 2018) and DWG (R13 to 2018) into the drawing model
# (`cad`), tessellated for a GPU.
dwg = ["dep:exav-unpack"]
@@ -89,11 +116,49 @@ vp-debug = ["dwg"]
ifc = []
# Binary and ASCII STL into the same meshes (`stl`, `mesh`).
stl = []
+# Wavefront OBJ (`obj`), Stanford PLY (`ply`) and glTF 2.0 with GLB (`gltf`,
+# with a JSON reader of its own) into the same meshes.
+obj = []
+ply = []
+gltf = []
+# Markdown into a tree of blocks and inlines (`markdown`), as data: no HTML
+# is ever made.
+markdown = ["dep:pulldown-cmark"]
+# The text of a document as a reader sees it, one entry for every kind that has
+# some (`text`): Markdown, HTML, Office and OpenDocument XML parts, PDF (hayro)
+# and drawings. For a scanner or a search; the viewer does not use it.
+text = ["markdown", "dwg", "exav-unpack/text"]
+# And PDF's, read by hayro: the largest part of `text`.
+text-pdf = ["text", "exav-unpack/text-pdf"]
+# And the office formats' the XML parts do not reach, from what `office`
+# reads: DOC, XLS, PPT, RTF, Word 2003 XML, SpreadsheetML 2003, SYLK, flat
+# OpenDocument, Numbers, Pages, Keynote.
+text-office = ["text", "office"]
+# What every office converter shares (`formats::office::common`): ZIP
+# packages, ODF's XML, code pages. Not a feature to ask for.
+_office = ["dep:zip", "dep:flate2", "dep:quick-xml", "dep:encoding_rs"]
+# Spreadsheets into XLSX (`sheets`): Excel 2 to 2003, ODS, FODS, OTS, Apple
+# Numbers, XML Spreadsheet 2003, HTML tables and SYLK. Also the chart writer
+# the presentations use for ODF charts.
+office-sheets = ["_office", "dep:md-5", "dep:sha1"]
+# Presentations into PPTX (`slides`): PowerPoint 95 and 97 to 2003, ODP, FODP,
+# OTP and Apple Keynote; drawings: ODG, OTG, FODG and Visio (VSDX).
+office-slides = ["_office", "dep:md-5", "dep:sha1"]
+# Text documents into DOCX (`docs`): Word 6 to 2003, ODT, FODT, OTT, RTF,
+# Word 2003 XML and Apple Pages.
+office-docs = ["_office"]
+# Every office converter.
+office = ["office-sheets", "office-slides", "office-docs"]
+# Writers of compound files, protobuf messages and Snappy blocks, for the
+# tests that build the documents they read. Not a feature to ask for.
+office-test-util = ["_office"]
[dev-dependencies]
serde_json = "1"
+# The strict compound file reader the lenient one of `office` is checked against.
+cfb = "0.15.0"
# The drawing fixtures are gzipped.
-flate2 = "1.0.20"
+flate2 = "1.1.10"
# The DWG oracle test names local corpus files by hash.
sha2 = "0.11"
@@ -129,6 +194,14 @@ required-features = ["dwg"]
name = "ifc"
required-features = ["ifc"]
+[[test]]
+name = "ifc_geometry"
+required-features = ["ifc"]
+
+[[test]]
+name = "ifc_hostile"
+required-features = ["ifc"]
+
[[test]]
name = "ifc_oracle"
required-features = ["ifc"]
@@ -137,6 +210,102 @@ required-features = ["ifc"]
name = "stl"
required-features = ["stl"]
+[[test]]
+name = "obj"
+required-features = ["obj"]
+
+[[test]]
+name = "ply"
+required-features = ["ply"]
+
+[[test]]
+name = "gltf"
+required-features = ["gltf"]
+
+[[test]]
+name = "jxl"
+required-features = ["jxl"]
+
+[[test]]
+name = "raw"
+required-features = ["raw"]
+
+[[test]]
+name = "markdown"
+required-features = ["markdown"]
+
+[[test]]
+name = "markdown_text"
+required-features = ["markdown"]
+
+[[test]]
+name = "text"
+required-features = ["text"]
+
+[[test]]
+name = "office_sheets"
+required-features = ["office-sheets"]
+
+[[test]]
+name = "office_text_sheets"
+required-features = ["office-sheets"]
+
+[[test]]
+name = "office_slides"
+required-features = ["office-slides", "office-test-util"]
+
+[[test]]
+name = "office_slides_draw"
+required-features = ["office-slides"]
+
+[[test]]
+name = "office_text_slides"
+required-features = ["office-slides"]
+
+[[test]]
+name = "office_slides_vsdx"
+required-features = ["office-slides", "office-test-util"]
+
+[[test]]
+name = "office_slides_keynote_xml"
+required-features = ["office-slides"]
+
+[[test]]
+name = "office_slides_odp_features"
+required-features = ["office-slides"]
+
+[[test]]
+name = "office_slides_old_ppt"
+required-features = ["office-slides", "office-test-util"]
+
+[[test]]
+name = "office_docs_doc"
+required-features = ["office-docs", "office-test-util"]
+
+[[test]]
+name = "office_docs_formats"
+required-features = ["office-docs", "office-test-util"]
+
+[[test]]
+name = "office_text_docs"
+required-features = ["office-docs", "office-test-util"]
+
+[[example]]
+name = "office_docs_convert"
+required-features = ["office-docs"]
+
+[[example]]
+name = "office_slides_convert"
+required-features = ["office-slides"]
+
+[[example]]
+name = "office_text"
+required-features = ["text-office"]
+
+[[example]]
+name = "raw_preview"
+required-features = ["raw"]
+
[[example]]
name = "cad_dump"
required-features = ["dwg"]
diff --git a/crates/exav-render/NOTICE b/crates/exav-render/NOTICE
new file mode 100644
index 0000000..65741e1
--- /dev/null
+++ b/crates/exav-render/NOTICE
@@ -0,0 +1,231 @@
+exav-render: notices
+====================
+
+exav-render is licensed under the MIT License (see LICENSE). This file
+covers the office converters (the `office-sheets`, `office-slides` and
+`office-docs` features, `src/formats/office/`). The vendored image decoders
+keep their licences in `src/image_codecs/` and the stroke font its
+dedication in `fonts/`; the notices of the rest of the workspace are in the
+repository's NOTICE.
+
+The office converters are written from published specifications and from the
+black-box behaviour of other converters (their output on sample files). No
+code of another office application is in them:
+
+- no code of another spreadsheet application is in `sheets`;
+- no code of another presentation application is in `slides`;
+- no code of another word-processing application is in `docs`, and none was
+ read while writing it;
+- `common` is written from published specifications alone.
+
+Specifications and documentation they follow
+--------------------------------------------
+
+Shared (`common`):
+
+- Microsoft's Open Specifications: [MS-CFB], under the Microsoft Open
+ Specifications Promise.
+- OASIS OpenDocument 1.2 and 1.3, for the namespaces.
+- Google's Snappy format description, and the protocol buffers encoding
+ documented at protobuf.dev.
+
+Spreadsheets (`sheets`):
+
+- Microsoft's Open Specifications: [MS-XLS], [MS-OFFCRYPTO], [MS-ODRAW],
+ [MS-CFB], under the Microsoft Open Specifications Promise.
+- OpenOffice.org's "Microsoft Excel File Format" documentation (Daniel
+ Rentz, Public Documentation License 1.0), for the BIFF2 to BIFF5 record
+ layouts [MS-XLS] does not give, and the argument counts of
+ src/formats/office/sheets/xls/ftab.rs (generated by
+ scripts/office/sheets/ftab.py).
+- OASIS OpenDocument 1.2 and 1.3, and OpenFormula.
+- ECMA-376 (Office Open XML), for the XLSX written.
+- Google's Snappy format description, and the protocol buffers encoding
+ documented at protobuf.dev.
+- Microsoft's "XML Spreadsheet Reference" (Office XP, 2001) for
+ SpreadsheetML; the "Microsoft Office HTML and XML Reference" (Office
+ 2000) for Excel's HTML; Microsoft's "SYLK summary" (sylksum.doc, 1986)
+ and knowledge base article Q64338 for SYLK, with ISO 6937 for its
+ escapes; ECMA-376 for column widths in pixels; the W3C's CSS Color
+ Module Level 4 for colour names.
+
+Presentations (`slides`):
+
+- Microsoft's Open Specifications: [MS-PPT], [MS-ODRAW], [MS-CFB],
+ [MS-OSHARED] and [MS-OFFCRYPTO] (to recognise encrypted files), under the
+ Microsoft Open Specifications Promise.
+- ECMA-376 (Office Open XML) Part 1, for the PPTX written, and its
+ presetShapeDefinitions.xml, for the preset shapes' names and adjustments.
+- OASIS OpenDocument 1.2 (Part 1) and 1.3 (Part 3, schema).
+- Google's Snappy format description, and the protocol buffers encoding
+ documented at protobuf.dev.
+- Apple's Technical Notes TN2067 (About the Keynote XML File Format, APXL
+ Schema) and TN2073 (Deconstructing a Keynote Document: Part One,
+ Slides), for Keynote 1 (src/formats/office/slides/keynote/apxl1.rs).
+- RFC 1741 (BinHex 4.0), to find the data fork of a Macintosh PowerPoint
+ file saved as text.
+- Visio drawings (src/formats/office/slides/vsdx): Microsoft's Visio file
+ format reference (Visio 2013 file format, learn.microsoft.com/office/
+ client-developer/visio: the Introduction, Schema map, Elements and Types
+ pages and the ShapeSheet reference pages of the geometry rows, the fill,
+ line, character, paragraph, text block, layer and hyperlink cells, and the
+ THEMEVAL and NURBS functions); [MS-VSDX] (Visio Graphics Service VSDX File
+ Format), under the Microsoft Open Specifications Promise, for the package
+ parts, the coordinate transforms, the inheritance of masters and styles,
+ the colour table, the fill patterns, line patterns and line ends (pictures
+ in it), the formula grammar and the theme; ECMA-376 Part 2 (Open
+ Packaging Conventions), for the package and its relationships.
+
+Text documents (`docs`):
+
+- Microsoft's Open Specifications: [MS-DOC], [MS-ODRAW], [MS-OSHARED] and
+ [MS-CFB], under the Microsoft Open Specifications Promise.
+- ECMA-376 (Office Open XML) Part 1, for the DOCX written.
+- OASIS OpenDocument 1.2 (Part 1) and 1.3 (Part 3, schema).
+- Microsoft's Rich Text Format specification, version 1.9.1, and the
+ WordprocessingML 2003 element and attribute names, for
+ src/formats/office/docs/rtf and src/formats/office/docs/wml.
+- Google's Snappy format description, and the protocol buffers encoding
+ documented at protobuf.dev, for Pages (through `common`).
+
+Formats nobody published
+------------------------
+
+- Microsoft published no description of PowerPoint 95 and of PowerPoint 2 to
+ 4, and Apple none of Keynote 2 to 5. src/formats/office/slides/ppt/ppt95.rs
+ and src/formats/office/slides/keynote/apxl.rs were written from sample
+ documents, the output of another office application on them used as a black
+ box (rendered pages, never its source code), and the structure of the files themselves.
+ src/formats/office/slides/ppt/old.rs reads only the headers of PowerPoint
+ 2 to 4, to report them as unsupported.
+
+- Apple published none of Pages. src/formats/office/docs/pages was written
+ from sample documents and the structure of the files themselves (the
+ document message's page size and margin fields were found there), with the
+ text messages' layout below.
+
+- The Numbers '08 and '09 reader (src/formats/office/sheets/numbers/v09.rs)
+ follows no description of the format: Apple published none. It was written
+ from sample documents (Apache Tika's, below, and others used only as
+ inputs), with another application's conversions of them as a black-box
+ reference.
+
+- The Visio reader (src/formats/office/slides/vsdx) is written from the
+ specifications listed above and from sample drawings used only as inputs:
+ 48 VSDX files collected from public bug trackers and test suites of other
+ projects (not part of this repository), to see what real files hold. Where
+ the specifications are silent, the reader follows what those files and
+ another application's rendering of them show, used as a black box (its PDF
+ of each file compared with ours, never any source code, which was not
+ read): the quick
+ style colours 200 to 206 (read as 100 to 106), the side an arc's bow
+ bulges to, and that a `Themed` value with no quick style of its own is the
+ root style sheet's. The gradient patterns 25 to 40 are approximations of
+ the pictures in [MS-VSDX]. Formats the reader leaves out: the binary .vsd
+ and the Visio 2003 XML .vdx.
+
+Data from other projects
+------------------------
+
+- src/formats/office/sheets/numbers/functions.rs (Numbers' function indexes)
+ and src/formats/office/sheets/numbers/fonts.rs (PostScript names of macOS
+ fonts and their families) are generated, by
+ scripts/office/sheets/numbers_functions.py and
+ scripts/office/sheets/numbers_fonts.py, from numbers-parser
+ (https://github.com/masaccio/numbers-parser), MIT:
+
+ Copyright 2021 Jon Connell
+
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to
+ permit persons to whom the Software is furnished to do so, subject to
+ the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+ The layout of the Numbers messages read (their field numbers) follows the
+ message definitions numbers-parser publishes under the same licence; the
+ older cell records follow SheetJS's reader (Apache-2.0). The record layout
+ of Keynote tables (src/formats/office/slides/keynote/table.rs) follows, for
+ the cell records, numbers-parser too, under the same licence.
+
+- The layout of the Keynote and Pages messages read (their type and field
+ numbers, named where src/formats/office/slides/keynote and
+ src/formats/office/docs/pages read them) follows the message definitions
+ keynote-parser (https://github.com/psobot/keynote-parser) publishes, MIT:
+
+ Copyright 2019-2025 Peter Sobot
+
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to
+ permit persons to whom the Software is furnished to do so, subject to
+ the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+- The code page tables (src/formats/office/common/codepage_tables.rs and
+ src/formats/office/sheets/codepage_tables.rs: the DOS and Mac code pages
+ encoding_rs does not have) are generated by
+ scripts/office/common/codepages.py and scripts/office/sheets/codepages.py
+ from the mapping tables of Python's codecs, which are the Unicode
+ Consortium's published mappings.
+
+Test fixtures
+-------------
+
+The fixtures are in tests/fixtures/office and are not packaged with the
+crate.
+
+- sheets/sample.numbers is numbers-parser's tests/data/issue-18.numbers (MIT,
+ as above); see sheets/README.md.
+
+- sheets/numbers09.numbers is Apache Tika's test document
+ testNumbers.numbers, unmodified, under the Apache License 2.0
+ (https://www.apache.org/licenses/LICENSE-2.0). Apache Tika, Copyright The
+ Apache Software Foundation; it includes software developed at The Apache
+ Software Foundation (http://www.apache.org/). It is a test input only.
+
+- slides/sample.key is keynote-parser's tests/data/simple-oneslide.key, under
+ the same licence as keynote-parser above.
+
+- draw/make_vsdx.py writes sample.vsdx and themed.vsdx, Visio drawings of
+ shapes written for this crate (CC0); see draw/README.md.
+
+- docs/make.py writes sample.odt, sample.fodt and sample.rtf from text
+ written for this crate (CC0). docs/sample.doc is a conversion
+ of sample.odt by an office application, and docs/sample-2003.xml was written by hand; none holds
+ anyone else's content.
+
+- tests/fixtures/dwg/make.py writes the drawings as DXF with ezdxf (MIT,
+ not distributed). The `.dwg.gz` files are those drawings converted to DWG by
+ the Open Design Alliance's ODA File Converter, run as a black box on the
+ maintainers' machines: no code or data of the converter is in the repository,
+ and the drawings are this crate's own, written for the tests and under its
+ licence. The converter's own terms
+ (https://www.opendesign.com) apply to the converter, not to the files it was
+ given. The DWG files carry the file-format markers ODA's writer puts in every
+ file.
diff --git a/crates/exav-render/README.md b/crates/exav-render/README.md
index 9ec8a07..25c1eac 100644
--- a/crates/exav-render/README.md
+++ b/crates/exav-render/README.md
@@ -13,11 +13,40 @@ behind [`@exav/viewer`](../exav-viewer) and the decoding half of
code (its only `unsafe`); see the README there. JPEG 2000 and JBIG2
files too (`jp2`, `jbig2`, default), through hayro-jpeg2000 and
hayro-jbig2 built without their SIMD code (libclamav decodes neither;
- exav-imagehash hashes them like the others).
+ exav-imagehash hashes them like the others). JPEG XL (`jxl`, not a
+ default) goes through zenjxl-decoder, a fork of the libjxl team's jxl-rs
+ that is `forbid(unsafe_code)`, built without its SIMD: the first frame, as
+ 8-bit grey or RGBA, within the caller's memory budget.
+- **Camera RAW files** (`raw`, default): the largest JPEG or RGB preview a
+ RAW file embeds, as 8-bit pixels with the Exif orientation applied
+ (`image::raw`, and `decode_any`). DNG, Canon CR2, CR3 and CRW, Nikon NEF and
+ NRW, Sony ARW, SR2 and SRF, Olympus ORF, Panasonic RW2, RAW and Leica RWL,
+ Fujifilm RAF, Pentax PEF, Samsung SRW, Hasselblad 3FR, Phase One IIQ, Sigma
+ X3F, Kodak, Epson, Mamiya and Leaf, told by their bytes, not their names: a
+ plain TIFF is not one of them and the TIFF decoder reads it. The sensor
+ data is not decoded, so a file that holds no preview (most phones' DNG) is
+ `Error::NoPreview`. The previews come from the tags TIFF 6.0 and DNG
+ define, and from a search of the file for the JPEG streams the makers keep
+ elsewhere. Written from the public specifications, see `raw.rs`.
- **PDF images** (`jp2`, `jbig2`, `ccitt`): the JPXDecode, JBIG2Decode and
CCITTFaxDecode images of PDF streams, into the buffers pdf.js reads from
its own decoders (`src/formats/pdf_image/`), which @exav/viewer gives
pdf.js in place of its OpenJPEG and PDFium builds.
+- **Markdown** (`markdown`, not a default): CommonMark with tables and
+ strikethrough, read by pulldown-cmark (without its `html` and `simd`
+ features: `forbid(unsafe_code)`) into a tree of blocks and inlines, as
+ data. Raw HTML is text, an image is its alt text, a link is kept only for
+ an absolute http, https or mailto address; nesting, columns and nodes are
+ bounded. `Document::to_json` is the shape @exav/viewer's page reads.
+- **The text of a document** (`text`, `text-pdf`, `text-office`; not used by
+ the viewer): `text::visible_text` gives the words a reader sees, for a
+ scanner or a search: Markdown, HTML, the XML parts of Office and
+ OpenDocument files, DWG and DXF, PDF (`text-pdf`, through hayro) and, with
+ `text-office`, DOC, XLS, PPT, RTF, Word 2003 XML, SpreadsheetML 2003, SYLK,
+ the flat OpenDocument files, Numbers, Pages and Keynote, taken from what
+ the office converters read, in sections (a sheet, a slide). A link is its
+ label then its target. A document of those kinds whose text could not be
+ taken out says so in `Visible::unreadable`.
- **DWG and DXF** (`dwg`): read into the drawing model below and
tessellated into GPU-ready buffers: strokes with their lineweight, fills,
text runs, layers and layouts. See `src/formats/dwg/`.
@@ -37,10 +66,50 @@ behind [`@exav/viewer`](../exav-viewer) and the decoding half of
(`mesh::Scene`): batches by class and colour, each element's ranges, its
GlobalId, class, name and storey, the spatial tree. Written from
buildingSMART's schemas and documentation, booleans and openings
- included. See `src/formats/ifc/`. Not drawn faithfully yet: conical,
- spherical and toroidal B-rep faces (flat), B-spline face trimming, IFC4X3
- alignments, sweep start/end parameters, grid placements (listed on
- exav.org's exav-render page).
+ included. See `src/formats/ifc/`. Wavefront OBJ (`obj`), Stanford PLY
+ (`ply`) and glTF 2.0 with GLB (`gltf`, with a JSON reader of its own and
+ no dependency) read into the same meshes, never opening another file.
+ B-rep faces on spheres, tori, cylinders and B-spline surfaces are meshed
+ in their surface's parameters (B-spline faces cut by their bounds),
+ sweeps honour their start and end parameters, IFC4X3 curve segments
+ (lines, circles, clothoids and the other spirals, polynomials), gradient
+ curves and linear placements along them are evaluated, grid placements
+ sit at their grid intersections, and each element and batch has its
+ building storey (`Element::storey`, `Batch::storey`, `Node::elevation`).
+ What is not drawn yet is on exav.org's exav-render page.
+
+- **Office documents** (`office-sheets`, `office-slides`, `office-docs`, or
+ `office` for the three; not defaults): converted to the Open XML package an
+ Open XML renderer draws, in the browser behind `@exav/viewer`. A
+ conversion is bounded by `Limits` (input, cells, slides, paragraphs,
+ memory, each decompressed part) and fails with `Error::TooLarge` rather
+ than convert part of a document. Nothing is recalculated and no macro runs.
+ - **Spreadsheets** (`sheets`, to XLSX): Excel 2.x to 2003 (BIFF2 to BIFF8,
+ a lenient compound file reader, default-password encryption), ODS, FODS
+ and OTS, Apple Numbers (Numbers 3 and later, and '08 and '09), and the
+ text formats Excel opens from a .xls file: XML Spreadsheet 2003, HTML
+ tables and SYLK. Values, formulas as text with their cached results,
+ styles and number formats, merges, conditional formats, validations,
+ comments, links, pictures, shapes and charts.
+ - **Presentations** (`slides`, to PPTX): PowerPoint 95 and 97 to 2003
+ (2 to 4 are recognised and reported as unsupported), ODP, FODP and OTP,
+ and Apple Keynote in every version. Masters, placeholders, styles,
+ shapes and their geometry, text, pictures, tables and charts, every
+ property resolved in the PPTX written. `convert_first` converts the first
+ slides only, `convert_first_from` reads a package part by part from any
+ `Read + Seek` source. Drawings too, a page to a slide in the pages'
+ largest size: ODG, OTG and FODG, and Visio 2013 and later (VSDX, VSDM,
+ VSTX, VSTM: shapes through their masters and styles, formulas where a
+ master's depend on the instance, geometry rows, splines, text, pictures,
+ layers, hyperlinks, the theme's colours; the binary .vsd and the Visio
+ 2003 XML .vdx are not read).
+ - **Text documents** (`docs`, to DOCX): Word 6 to 2003, ODT, OTT and FODT,
+ RTF, Word 2003 XML and Apple Pages (text, page size and margins). Styles
+ stay styles; sections with headers and footers, lists, tables, notes,
+ comments, fields, pictures and OfficeArt shapes.
+ - Encrypted files are refused. Fuzzed by the `sheets_*`, `slides_*` and
+ `docs_*` targets (docs/FUZZING.md). See NOTICE for the specifications
+ and data they are written from.
The crate is `forbid(unsafe_code)`.
@@ -53,5 +122,12 @@ let rgba = pixels.to_rgba8();
# Ok::<(), Box>(())
```
+```rust,ignore
+// With the `office-sheets` feature.
+use exav_render::sheets::{convert, Format, Limits};
+
+let xlsx = convert(&bytes, Format::Ods, &Limits::default())?.xlsx;
+```
+
MIT. The vendored decoders keep their licences (`src/image_codecs/`), and
the NewStroke stroke font its CC0-1.0 dedication (`fonts/`).
diff --git a/crates/exav-render/examples/office_docs_convert.rs b/crates/exav-render/examples/office_docs_convert.rs
new file mode 100644
index 0000000..a72984d
--- /dev/null
+++ b/crates/exav-render/examples/office_docs_convert.rs
@@ -0,0 +1,108 @@
+//! Converts files from the command line:
+//! `cargo run -p exav-render --features office-docs --example office_docs_convert -- `.
+//!
+//! `convert one ` converts one file.
+//! `convert batch ` converts every file of a
+//! directory, writing `/.docx` and printing one JSON line
+//! per file: its name, the outcome, the time in microseconds, the size of
+//! the DOCX, and the warnings.
+
+use exav_render::docs::{convert, Format, Limits};
+use std::time::Instant;
+
+fn format(name: &str) -> Format {
+ Format::from_extension(name).unwrap_or_else(|| {
+ eprintln!("unknown format {name}");
+ std::process::exit(2);
+ })
+}
+
+fn json(s: &str) -> String {
+ let mut o = String::from("\"");
+ for c in s.chars() {
+ match c {
+ '"' => o.push_str("\\\""),
+ '\\' => o.push_str("\\\\"),
+ '\n' => o.push_str("\\n"),
+ c if (c as u32) < 0x20 => o.push(' '),
+ c => o.push(c),
+ }
+ }
+ o.push('"');
+ o
+}
+
+fn main() {
+ let args: Vec = std::env::args().skip(1).collect();
+ let limits = Limits::default();
+ match args.iter().map(String::as_str).collect::>()[..] {
+ ["one", fmt, input, output] => {
+ let bytes = std::fs::read(input).expect("read the input");
+ match convert(&bytes, format(fmt), &limits) {
+ Ok(c) => {
+ std::fs::write(output, &c.docx).expect("write the output");
+ for w in &c.warnings {
+ eprintln!("warning: {w}");
+ }
+ }
+ Err(e) => {
+ eprintln!("{}: {e}", e.kind());
+ std::process::exit(1);
+ }
+ }
+ }
+ ["batch", fmt, dir, out] => {
+ let fmt = format(fmt);
+ std::fs::create_dir_all(out).expect("create the output directory");
+ let mut names: Vec<_> = std::fs::read_dir(dir)
+ .expect("read the directory")
+ .filter_map(|e| e.ok())
+ .map(|e| e.path())
+ .collect();
+ names.sort();
+ for p in names {
+ let name = p
+ .file_name()
+ .unwrap_or_default()
+ .to_string_lossy()
+ .to_string();
+ let Ok(bytes) = std::fs::read(&p) else {
+ continue;
+ };
+ let t = Instant::now();
+ let r = std::panic::catch_unwind(|| convert(&bytes, fmt, &Limits::default()));
+ let us = t.elapsed().as_micros();
+ match r {
+ Ok(Ok(c)) => {
+ let stem = name.rsplit_once('.').map(|s| s.0).unwrap_or(&name);
+ std::fs::write(format!("{out}/{stem}.docx"), &c.docx).expect("write");
+ let w: Vec = c.warnings.iter().map(|w| json(w)).collect();
+ println!(
+ "{{\"name\":{},\"ok\":true,\"us\":{us},\"size\":{},\"paragraphs\":{},\"warnings\":[{}]}}",
+ json(&name),
+ c.docx.len(),
+ c.paragraphs,
+ w.join(",")
+ );
+ }
+ Ok(Err(e)) => println!(
+ "{{\"name\":{},\"ok\":false,\"kind\":\"{}\",\"error\":{},\"us\":{us}}}",
+ json(&name),
+ e.kind(),
+ json(&e.to_string())
+ ),
+ Err(_) => println!(
+ "{{\"name\":{},\"ok\":false,\"kind\":\"panic\",\"error\":\"panic\",\"us\":{us}}}",
+ json(&name)
+ ),
+ }
+ }
+ }
+ _ => {
+ eprintln!(
+ "usage: convert one | convert batch "
+ );
+ std::process::exit(2);
+ }
+ }
+}
diff --git a/crates/exav-render/examples/office_slides_convert.rs b/crates/exav-render/examples/office_slides_convert.rs
new file mode 100644
index 0000000..864563e
--- /dev/null
+++ b/crates/exav-render/examples/office_slides_convert.rs
@@ -0,0 +1,106 @@
+//! Converts presentations and drawings from the command line:
+//! `cargo run -p exav-render --features office-slides --example office_slides_convert -- `.
+//!
+//! `one ` converts one file.
+//! `batch ` converts every file of a directory,
+//! writing `/.pptx` and printing one JSON line per file: its
+//! name, the outcome, the time in microseconds, the size of the PPTX, the
+//! slides, and the warnings.
+
+use exav_render::slides::{convert, Format, Limits};
+use std::time::Instant;
+
+fn format(name: &str) -> Format {
+ Format::from_extension(name).unwrap_or_else(|| {
+ eprintln!("unknown format {name}");
+ std::process::exit(2);
+ })
+}
+
+fn json(s: &str) -> String {
+ let mut o = String::from("\"");
+ for c in s.chars() {
+ match c {
+ '"' => o.push_str("\\\""),
+ '\\' => o.push_str("\\\\"),
+ '\n' => o.push_str("\\n"),
+ c if (c as u32) < 0x20 => o.push(' '),
+ c => o.push(c),
+ }
+ }
+ o.push('"');
+ o
+}
+
+fn main() {
+ let args: Vec = std::env::args().skip(1).collect();
+ let limits = Limits::default();
+ match args.iter().map(String::as_str).collect::>()[..] {
+ ["one", fmt, input, output] => {
+ let bytes = std::fs::read(input).expect("read the input");
+ match convert(&bytes, format(fmt), &limits) {
+ Ok(c) => {
+ std::fs::write(output, &c.pptx).expect("write the output");
+ for w in &c.warnings {
+ eprintln!("warning: {w}");
+ }
+ }
+ Err(e) => {
+ eprintln!("{}: {e}", e.kind());
+ std::process::exit(1);
+ }
+ }
+ }
+ ["batch", fmt, dir, out] => {
+ let fmt = format(fmt);
+ std::fs::create_dir_all(out).expect("create the output directory");
+ let mut names: Vec<_> = std::fs::read_dir(dir)
+ .expect("read the directory")
+ .filter_map(|e| e.ok())
+ .map(|e| e.path())
+ .collect();
+ names.sort();
+ for p in names {
+ let name = p
+ .file_name()
+ .unwrap_or_default()
+ .to_string_lossy()
+ .to_string();
+ let Ok(bytes) = std::fs::read(&p) else {
+ continue;
+ };
+ let t = Instant::now();
+ let r = std::panic::catch_unwind(|| convert(&bytes, fmt, &Limits::default()));
+ let us = t.elapsed().as_micros();
+ match r {
+ Ok(Ok(c)) => {
+ let stem = name.rsplit_once('.').map(|s| s.0).unwrap_or(&name);
+ std::fs::write(format!("{out}/{stem}.pptx"), &c.pptx).expect("write");
+ let w: Vec = c.warnings.iter().map(|w| json(w)).collect();
+ println!(
+ "{{\"name\":{},\"ok\":true,\"us\":{us},\"size\":{},\"slides\":{},\"warnings\":[{}]}}",
+ json(&name),
+ c.pptx.len(),
+ c.slides,
+ w.join(",")
+ );
+ }
+ Ok(Err(e)) => println!(
+ "{{\"name\":{},\"ok\":false,\"kind\":\"{}\",\"error\":{},\"us\":{us}}}",
+ json(&name),
+ e.kind(),
+ json(&e.to_string())
+ ),
+ Err(_) => println!(
+ "{{\"name\":{},\"ok\":false,\"kind\":\"panic\",\"error\":\"panic\",\"us\":{us}}}",
+ json(&name)
+ ),
+ }
+ }
+ }
+ _ => {
+ eprintln!("usage: one | batch ");
+ std::process::exit(2);
+ }
+ }
+}
diff --git a/crates/exav-render/examples/office_text.rs b/crates/exav-render/examples/office_text.rs
new file mode 100644
index 0000000..5493b8f
--- /dev/null
+++ b/crates/exav-render/examples/office_text.rs
@@ -0,0 +1,87 @@
+//! The text of office documents, as the scanner and `exav-grep --text` read it:
+//! `cargo run --release -p exav-render --features text-office --example office_text -- `.
+//!
+//! `one ` prints the file's sections and its text, and the links.
+//! `bench ` reads every file of a directory (not recursively) and prints
+//! one JSON line each, the name, the outcome, the microseconds and the text's
+//! bytes, then the totals.
+
+use exav_render::text::visible_text;
+use std::time::Instant;
+
+fn main() {
+ let args: Vec = std::env::args().skip(1).collect();
+ let limits = exav_unpack::Limits::default();
+ match args.iter().map(String::as_str).collect::>()[..] {
+ ["one", file] => {
+ let data = std::fs::read(file).expect("read the file");
+ let name = file.rsplit('/').next().unwrap_or(file);
+ match visible_text(name, &data, 1 << 24, &limits) {
+ None => println!("no text view"),
+ Some(v) => {
+ if let Some(why) = &v.unreadable {
+ println!("unreadable: {why}");
+ }
+ for (label, range) in &v.sections {
+ println!("--- {label} ({} bytes)", range.len());
+ }
+ print!("{}", v.text);
+ for (label, target) in &v.links {
+ println!("link: {label} -> {target}");
+ }
+ }
+ }
+ }
+ ["bench", dir] => {
+ let mut names: Vec<_> = std::fs::read_dir(dir)
+ .expect("read the directory")
+ .filter_map(|e| e.ok())
+ .map(|e| e.path())
+ .filter(|p| p.is_file())
+ .collect();
+ names.sort();
+ let (mut bytes, mut micros, mut read) = (0u64, 0u128, 0u32);
+ for p in names {
+ let Ok(data) = std::fs::read(&p) else {
+ continue;
+ };
+ let name = p
+ .file_name()
+ .unwrap_or_default()
+ .to_string_lossy()
+ .to_string();
+ let t = Instant::now();
+ let r = std::panic::catch_unwind(|| {
+ visible_text(&name, &data, 1 << 24, &exav_unpack::Limits::default())
+ });
+ let us = t.elapsed().as_micros();
+ let outcome = match &r {
+ Ok(Some(v)) if v.unreadable.is_some() => "unreadable",
+ Ok(Some(_)) => "text",
+ Ok(None) => "none",
+ Err(_) => "panic",
+ };
+ let text = match &r {
+ Ok(Some(v)) => v.text.len(),
+ _ => 0,
+ };
+ if outcome == "text" {
+ bytes += data.len() as u64;
+ micros += us;
+ read += 1;
+ }
+ println!(
+ "{{\"name\":{name:?},\"outcome\":\"{outcome}\",\"us\":{us},\"text\":{text}}}"
+ );
+ }
+ println!(
+ "{{\"documents\":{read},\"input_bytes\":{bytes},\"us\":{micros},\"mb_per_s\":{:.1}}}",
+ bytes as f64 / micros.max(1) as f64
+ );
+ }
+ _ => {
+ eprintln!("usage: one | bench ");
+ std::process::exit(2);
+ }
+ }
+}
diff --git a/crates/exav-render/examples/raw_preview.rs b/crates/exav-render/examples/raw_preview.rs
new file mode 100644
index 0000000..a1385fb
--- /dev/null
+++ b/crates/exav-render/examples/raw_preview.rs
@@ -0,0 +1,73 @@
+//! Print what the RAW reader makes of each file given: its family, the
+//! preview chosen, and how long it took, one tab-separated line a file. With
+//! `--png DIR`, the preview is also saved there as `.png`.
+//!
+//! cargo run --release -p exav-render --example raw_preview -- \
+//! [--png DIR] [--budget BYTES] ...
+
+use std::time::Instant;
+
+use exav_render::image::raw;
+use exav_render::image::DECODE_MAX;
+
+fn main() {
+ let mut args = std::env::args().skip(1).peekable();
+ let (mut png_dir, mut budget) = (None, DECODE_MAX);
+ let mut files = Vec::new();
+ while let Some(a) = args.next() {
+ match a.as_str() {
+ "--png" => png_dir = args.next(),
+ "--budget" => budget = args.next().and_then(|v| v.parse().ok()).unwrap_or(budget),
+ _ => files.push(a),
+ }
+ }
+ for f in files {
+ let data = match std::fs::read(&f) {
+ Ok(d) => d,
+ Err(e) => {
+ println!("{f}\tERR\tread: {e}");
+ continue;
+ }
+ };
+ let name = std::path::Path::new(&f)
+ .file_name()
+ .map_or_else(String::new, |n| n.to_string_lossy().into_owned());
+ let started = Instant::now();
+ let result = raw::preview(&data, budget);
+ let ms = started.elapsed().as_millis();
+ match result {
+ Ok((pixels, info)) => {
+ println!(
+ "{name}\t{}\t{}x{}\to{}\t{}\tfound {}\tout {}x{}\t{ms} ms",
+ info.kind.name(),
+ info.width,
+ info.height,
+ info.orientation,
+ if info.jpeg { "jpeg" } else { "samples" },
+ info.found,
+ pixels.width,
+ pixels.height,
+ );
+ if let Some(dir) = &png_dir {
+ let rgba = pixels.to_rgba8();
+ if let Some(img) = image::RgbaImage::from_raw(pixels.width, pixels.height, rgba)
+ {
+ let _ = img.save(format!("{dir}/{name}.png"));
+ }
+ }
+ }
+ // Not a RAW file for the reader: `decode_any` reads it as the
+ // image it may be (a plain TIFF).
+ Err(exav_render::image::Error::Unsupported) => {
+ match exav_render::image::decode_any(&data, budget) {
+ Ok(p) => println!("{name}\tOTHER\t{}x{}\t{ms} ms", p.width, p.height),
+ Err(e) => println!("{name}\t-\tERR\t{e}\t{ms} ms"),
+ }
+ }
+ Err(e) => match raw::detect(&data) {
+ Some(kind) => println!("{name}\t{}\tERR\t{e}\t{ms} ms", kind.name()),
+ None => println!("{name}\t-\tERR\t{e}\t{ms} ms"),
+ },
+ }
+ }
+}
diff --git a/crates/exav-render/examples/scene_stats.rs b/crates/exav-render/examples/scene_stats.rs
index 61d471b..4f07970 100644
--- a/crates/exav-render/examples/scene_stats.rs
+++ b/crates/exav-render/examples/scene_stats.rs
@@ -222,9 +222,11 @@ fn summarise(out: &mut String, d: &Drawing) {
.map(|b| String::from_utf8_lossy(b).into_owned())
.unwrap_or_default();
texts.push(format!(
- "{s}|h={}|rot={}|align={},{}|face={}|rgba={:08x}",
+ "{s}|u={},{}|v={},{}|align={},{}|face={}|rgba={:08x}",
sig(f32_at(r, 8)),
sig(f32_at(r, 12)),
+ sig(f32_at(r, 16)),
+ sig(f32_at(r, 20)),
r[38],
r[39],
r[44],
diff --git a/crates/exav-render/scripts/font-tables.py b/crates/exav-render/scripts/font-tables.py
index f42c1f8..ff9b503 100644
--- a/crates/exav-render/scripts/font-tables.py
+++ b/crates/exav-render/scripts/font-tables.py
@@ -44,8 +44,14 @@
0x2206, 0x2300, # increment, diameter
0x2264, 0x2265, 0x2260, # <=, >=, !=
0x00B0, 0x00B1, 0x00B2, 0x00B3, # already dense, listed to assert
- 0x03A9, 0x03BC, # ohm, micro
+ 0x2200, 0x2203, 0x220B, 0x2217, # Symbol's for all, exists, contains, star
+ 0x2212, 0x2234, 0x223C, 0x2245, # minus, therefore, tilde, congruent
+ 0x22A5, # perpendicular
}
+ # Greek, with Symbol's theta, phi and pi symbols, and basic Cyrillic:
+ # what Greek and Russian notes on a sheet are written in.
+ | set(range(0x0384, 0x03D7))
+ | set(range(0x0400, 0x0460))
)
# Fixed-point divisor for a stored advance, in em units. An advance is under
diff --git a/crates/exav-render/scripts/office/common/codepages.py b/crates/exav-render/scripts/office/common/codepages.py
new file mode 100644
index 0000000..668206c
--- /dev/null
+++ b/crates/exav-render/scripts/office/common/codepages.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Writes src/formats/office/common/codepage_tables.rs: the single-byte DOS and
+Mac code pages that encoding_rs does not have, as tables of 256 UTF-16 code
+units, from Python's own codecs. Undefined bytes map to U+FFFD.
+
+usage, from crates/exav-render:
+python3 -I scripts/office/common/codepages.py > src/formats/office/common/codepage_tables.rs
+"""
+
+PAGES = [
+ (437, "cp437"),
+ (720, "cp720"),
+ (737, "cp737"),
+ (775, "cp775"),
+ (850, "cp850"),
+ (852, "cp852"),
+ (855, "cp855"),
+ (857, "cp857"),
+ (858, "cp858"),
+ (860, "cp860"),
+ (861, "cp861"),
+ (862, "cp862"),
+ (863, "cp863"),
+ (864, "cp864"),
+ (865, "cp865"),
+ (869, "cp869"),
+ (10006, "mac_greek"),
+ (10029, "mac_latin2"),
+ (10079, "mac_iceland"),
+ (10081, "mac_turkish"),
+]
+
+
+def table(codec):
+ out = []
+ for b in range(256):
+ try:
+ s = bytes([b]).decode(codec)
+ except UnicodeDecodeError:
+ s = "�"
+ cp = ord(s) if len(s) == 1 else 0xFFFD
+ if cp > 0xFFFF:
+ cp = 0xFFFD
+ out.append(cp)
+ return out
+
+
+print("// Generated by scripts/office/common/codepages.py from Python's codecs. Do not edit.")
+print()
+print("/// (code page, its 256 characters).")
+print("#[rustfmt::skip]")
+print("pub(crate) static TABLES: &[(u16, [u16; 256])] = &[")
+for cp, codec in PAGES:
+ t = table(codec)
+ print(f" // {codec}")
+ print(f" ({cp}, [")
+ for i in range(0, 256, 16):
+ print(" " + ", ".join(f"0x{x:04X}" for x in t[i:i + 16]) + ",")
+ print(" ]),")
+print("];")
diff --git a/crates/exav-render/scripts/office/sheets/ftab.json b/crates/exav-render/scripts/office/sheets/ftab.json
new file mode 100644
index 0000000..0de7e7f
--- /dev/null
+++ b/crates/exav-render/scripts/office/sheets/ftab.json
@@ -0,0 +1,375 @@
+[
+[0, "COUNT", -1],
+[1, "IF", -1],
+[2, "ISNA", 1],
+[3, "ISERROR", 1],
+[4, "SUM", -1],
+[5, "AVERAGE", -1],
+[6, "MIN", -1],
+[7, "MAX", -1],
+[8, "ROW", -1],
+[9, "COLUMN", -1],
+[10, "NA", 0],
+[11, "NPV", -1],
+[12, "STDEV", -1],
+[13, "DOLLAR", -1],
+[14, "FIXED", -1],
+[15, "SIN", 1],
+[16, "COS", 1],
+[17, "TAN", 1],
+[18, "ATAN", 1],
+[19, "PI", 0],
+[20, "SQRT", 1],
+[21, "EXP", 1],
+[22, "LN", 1],
+[23, "LOG10", 1],
+[24, "ABS", 1],
+[25, "INT", 1],
+[26, "SIGN", 1],
+[27, "ROUND", 2],
+[28, "LOOKUP", -1],
+[29, "INDEX", -1],
+[30, "REPT", 2],
+[31, "MID", 3],
+[32, "LEN", 1],
+[33, "VALUE", 1],
+[34, "TRUE", 0],
+[35, "FALSE", 0],
+[36, "AND", -1],
+[37, "OR", -1],
+[38, "NOT", 1],
+[39, "MOD", 2],
+[40, "DCOUNT", 3],
+[41, "DSUM", 3],
+[42, "DAVERAGE", 3],
+[43, "DMIN", 3],
+[44, "DMAX", 3],
+[45, "DSTDEV", 3],
+[46, "VAR", -1],
+[47, "DVAR", 3],
+[48, "TEXT", 2],
+[49, "LINEST", -1],
+[50, "TREND", -1],
+[51, "LOGEST", -1],
+[52, "GROWTH", -1],
+[53, "GOTO", 1],
+[54, "HALT", -1],
+[55, "RETURN", -1],
+[56, "PV", -1],
+[57, "FV", -1],
+[58, "NPER", -1],
+[59, "PMT", -1],
+[60, "RATE", -1],
+[61, "MIRR", 3],
+[62, "IRR", -1],
+[63, "RAND", 0],
+[64, "MATCH", -1],
+[65, "DATE", 3],
+[66, "TIME", 3],
+[67, "DAY", 1],
+[68, "MONTH", 1],
+[69, "YEAR", 1],
+[70, "WEEKDAY", -1],
+[71, "HOUR", 1],
+[72, "MINUTE", 1],
+[73, "SECOND", 1],
+[74, "NOW", 0],
+[75, "AREAS", 1],
+[76, "ROWS", 1],
+[77, "COLUMNS", 1],
+[78, "OFFSET", -1],
+[79, "ABSREF", 2],
+[80, "RELREF", 2],
+[81, "ARGUMENT", -1],
+[82, "SEARCH", -1],
+[83, "TRANSPOSE", 1],
+[84, "ERROR", -1],
+[85, "STEP", 0],
+[86, "TYPE", 1],
+[87, "ECHO", -1],
+[88, "SET.NAME", -1],
+[89, "CALLER", 0],
+[90, "DEREF", 1],
+[91, "WINDOWS", -1],
+[92, "SERIES", -1],
+[93, "DOCUMENTS", -1],
+[94, "ACTIVE.CELL", 0],
+[95, "SELECTION", 0],
+[96, "RESULT", -1],
+[97, "ATAN2", 2],
+[98, "ASIN", 1],
+[99, "ACOS", 1],
+[100, "CHOOSE", -1],
+[101, "HLOOKUP", -1],
+[102, "VLOOKUP", -1],
+[103, "LINKS", -1],
+[104, "INPUT", -1],
+[105, "ISREF", 1],
+[106, "GET.FORMULA", 1],
+[107, "GET.NAME", -1],
+[108, "SET.VALUE", 2],
+[109, "LOG", -1],
+[110, "EXEC", -1],
+[111, "CHAR", 1],
+[112, "LOWER", 1],
+[113, "UPPER", 1],
+[114, "PROPER", 1],
+[115, "LEFT", -1],
+[116, "RIGHT", -1],
+[117, "EXACT", 2],
+[118, "TRIM", 1],
+[119, "REPLACE", 4],
+[120, "SUBSTITUTE", -1],
+[121, "CODE", 1],
+[122, "NAMES", -1],
+[123, "DIRECTORY", -1],
+[124, "FIND", -1],
+[125, "CELL", -1],
+[126, "ISERR", 1],
+[127, "ISTEXT", 1],
+[128, "ISNUMBER", 1],
+[129, "ISBLANK", 1],
+[130, "T", 1],
+[131, "N", 1],
+[132, "FOPEN", -1],
+[133, "FCLOSE", 1],
+[134, "FSIZE", 1],
+[135, "FREADLN", 1],
+[136, "FREAD", 2],
+[137, "FWRITELN", 2],
+[138, "FWRITE", 2],
+[139, "FPOS", -1],
+[140, "DATEVALUE", 1],
+[141, "TIMEVALUE", 1],
+[142, "SLN", 3],
+[143, "SYD", 4],
+[144, "DDB", -1],
+[145, "GET.DEF", -1],
+[146, "REFTEXT", -1],
+[147, "TEXTREF", -1],
+[148, "INDIRECT", -1],
+[149, "REGISTER", -1],
+[150, "CALL", -1],
+[151, "ADD.BAR", -1],
+[152, "ADD.MENU", -1],
+[153, "ADD.COMMAND", -1],
+[154, "ENABLE.COMMAND", -1],
+[155, "CHECK.COMMAND", -1],
+[156, "RENAME.COMMAND", -1],
+[157, "SHOW.BAR", -1],
+[158, "DELETE.MENU", -1],
+[159, "DELETE.COMMAND", -1],
+[160, "GET.CHART.ITEM", -1],
+[161, "DIALOG.BOX", 1],
+[162, "CLEAN", 1],
+[163, "MDETERM", 1],
+[164, "MINVERSE", 1],
+[165, "MMULT", 2],
+[166, "FILES", -1],
+[167, "IPMT", -1],
+[168, "PPMT", -1],
+[169, "COUNTA", -1],
+[170, "CANCEL.KEY", -1],
+[171, "FOR", -1],
+[172, "WHILE", 1],
+[173, "BREAK", 0],
+[174, "NEXT", 0],
+[175, "INITIATE", 2],
+[176, "REQUEST", 2],
+[177, "POKE", 3],
+[178, "EXECUTE", 2],
+[179, "TERMINATE", 1],
+[180, "RESTART", -1],
+[181, "HELP", -1],
+[182, "GET.BAR", -1],
+[183, "PRODUCT", -1],
+[184, "FACT", 1],
+[185, "GET.CELL", -1],
+[186, "GET.WORKSPACE", 1],
+[187, "GET.WINDOW", -1],
+[188, "GET.DOCUMENT", -1],
+[189, "DPRODUCT", 3],
+[190, "ISNONTEXT", 1],
+[191, "GET.NOTE", -1],
+[192, "NOTE", -1],
+[193, "STDEVP", -1],
+[194, "VARP", -1],
+[195, "DSTDEVP", 3],
+[196, "DVARP", 3],
+[197, "TRUNC", -1],
+[198, "ISLOGICAL", 1],
+[199, "DCOUNTA", 3],
+[200, "DELETE.BAR", 1],
+[201, "UNREGISTER", 1],
+[204, "USDOLLAR", -1],
+[205, "FINDB", -1],
+[206, "SEARCHB", -1],
+[207, "REPLACEB", 4],
+[208, "LEFTB", -1],
+[209, "RIGHTB", -1],
+[210, "MIDB", 3],
+[211, "LENB", 1],
+[212, "ROUNDUP", 2],
+[213, "ROUNDDOWN", 2],
+[214, "ASC", 1],
+[215, "DBCS", 1],
+[216, "RANK", -1],
+[219, "ADDRESS", -1],
+[220, "DAYS360", -1],
+[221, "TODAY", 0],
+[222, "VDB", -1],
+[223, "ELSE", 0],
+[224, "ELSE.IF", 1],
+[225, "END.IF", 0],
+[226, "FOR.CELL", -1],
+[227, "MEDIAN", -1],
+[228, "SUMPRODUCT", -1],
+[229, "SINH", 1],
+[230, "COSH", 1],
+[231, "TANH", 1],
+[232, "ASINH", 1],
+[233, "ACOSH", 1],
+[234, "ATANH", 1],
+[235, "DGET", 3],
+[236, "CREATE.OBJECT", -1],
+[237, "VOLATILE", -1],
+[238, "LAST.ERROR", 0],
+[239, "CUSTOM.UNDO", -1],
+[240, "CUSTOM.REPEAT", -1],
+[241, "FORMULA.CONVERT", -1],
+[242, "GET.LINK.INFO", -1],
+[243, "TEXT.BOX", -1],
+[244, "INFO", 1],
+[245, "GROUP", 0],
+[246, "GET.OBJECT", -1],
+[247, "DB", -1],
+[248, "PAUSE", -1],
+[251, "RESUME", -1],
+[252, "FREQUENCY", 2],
+[253, "ADD.TOOLBAR", -1],
+[254, "DELETE.TOOLBAR", 1],
+[255, "User Defined Function", -1],
+[256, "RESET.TOOLBAR", 1],
+[257, "EVALUATE", 1],
+[258, "GET.TOOLBAR", -1],
+[259, "GET.TOOL", -1],
+[260, "SPELLING.CHECK", -1],
+[261, "ERROR.TYPE", 1],
+[262, "APP.TITLE", -1],
+[263, "WINDOW.TITLE", -1],
+[264, "SAVE.TOOLBAR", -1],
+[265, "ENABLE.TOOL", 3],
+[266, "PRESS.TOOL", 3],
+[267, "REGISTER.ID", -1],
+[268, "GET.WORKBOOK", -1],
+[269, "AVEDEV", -1],
+[270, "BETADIST", -1],
+[271, "GAMMALN", 1],
+[272, "BETAINV", -1],
+[273, "BINOMDIST", 4],
+[274, "CHIDIST", 2],
+[275, "CHIINV", 2],
+[276, "COMBIN", 2],
+[277, "CONFIDENCE", 3],
+[278, "CRITBINOM", 3],
+[279, "EVEN", 1],
+[280, "EXPONDIST", 3],
+[281, "FDIST", 3],
+[282, "FINV", 3],
+[283, "FISHER", 1],
+[284, "FISHERINV", 1],
+[285, "FLOOR", 2],
+[286, "GAMMADIST", 4],
+[287, "GAMMAINV", 3],
+[288, "CEILING", 2],
+[289, "HYPGEOMDIST", 4],
+[290, "LOGNORMDIST", 3],
+[291, "LOGINV", 3],
+[292, "NEGBINOMDIST", 3],
+[293, "NORMDIST", 4],
+[294, "NORMSDIST", 1],
+[295, "NORMINV", 3],
+[296, "NORMSINV", 1],
+[297, "STANDARDIZE", 3],
+[298, "ODD", 1],
+[299, "PERMUT", 2],
+[300, "POISSON", 3],
+[301, "TDIST", 3],
+[302, "WEIBULL", 4],
+[303, "SUMXMY2", 2],
+[304, "SUMX2MY2", 2],
+[305, "SUMX2PY2", 2],
+[306, "CHITEST", 2],
+[307, "CORREL", 2],
+[308, "COVAR", 2],
+[309, "FORECAST", 3],
+[310, "FTEST", 2],
+[311, "INTERCEPT", 2],
+[312, "PEARSON", 2],
+[313, "RSQ", 2],
+[314, "STEYX", 2],
+[315, "SLOPE", 2],
+[316, "TTEST", 4],
+[317, "PROB", -1],
+[318, "DEVSQ", -1],
+[319, "GEOMEAN", -1],
+[320, "HARMEAN", -1],
+[321, "SUMSQ", -1],
+[322, "KURT", -1],
+[323, "SKEW", -1],
+[324, "ZTEST", -1],
+[325, "LARGE", 2],
+[326, "SMALL", 2],
+[327, "QUARTILE", 2],
+[328, "PERCENTILE", 2],
+[329, "PERCENTRANK", -1],
+[330, "MODE", -1],
+[331, "TRIMMEAN", 2],
+[332, "TINV", 2],
+[334, "MOVIE.COMMAND", -1],
+[335, "GET.MOVIE", -1],
+[336, "CONCATENATE", -1],
+[337, "POWER", 2],
+[338, "PIVOT.ADD.DATA", -1],
+[339, "GET.PIVOT.TABLE", -1],
+[340, "GET.PIVOT.FIELD", -1],
+[341, "GET.PIVOT.ITEM", -1],
+[342, "RADIANS", 1],
+[343, "DEGREES", 1],
+[344, "SUBTOTAL", -1],
+[345, "SUMIF", -1],
+[346, "COUNTIF", 2],
+[347, "COUNTBLANK", 1],
+[348, "SCENARIO.GET", -1],
+[349, "OPTIONS.LISTS.GET", 1],
+[350, "ISPMT", 4],
+[351, "DATEDIF", 3],
+[352, "DATESTRING", 1],
+[353, "NUMBERSTRING", 2],
+[354, "ROMAN", -1],
+[355, "OPEN.DIALOG", -1],
+[356, "SAVE.DIALOG", -1],
+[357, "VIEW.GET", -1],
+[358, "GETPIVOTDATA", -1],
+[359, "HYPERLINK", -1],
+[360, "PHONETIC", 1],
+[361, "AVERAGEA", -1],
+[362, "MAXA", -1],
+[363, "MINA", -1],
+[364, "STDEVPA", -1],
+[365, "VARPA", -1],
+[366, "STDEVA", -1],
+[367, "VARA", -1],
+[368, "BAHTTEXT", 1],
+[369, "THAIDAYOFWEEK", 1],
+[370, "THAIDIGIT", 1],
+[371, "THAIMONTHOFYEAR", 1],
+[372, "THAINUMSOUND", 1],
+[373, "THAINUMSTRING", 1],
+[374, "THAISTRINGLENGTH", 1],
+[375, "ISTHAIDIGIT", 1],
+[376, "ROUNDBAHTDOWN", 1],
+[377, "ROUNDBAHTUP", 1],
+[378, "THAIYEAR", 1],
+[379, "RTD", -1]
+]
diff --git a/crates/exav-render/scripts/office/sheets/ftab.py b/crates/exav-render/scripts/office/sheets/ftab.py
new file mode 100644
index 0000000..a9875a4
--- /dev/null
+++ b/crates/exav-render/scripts/office/sheets/ftab.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+"""Writes src/formats/office/sheets/xls/ftab.rs, the table of Excel's built-in
+functions by their BIFF index, from scripts/office/sheets/ftab.json: rows of
+[index, name, fixed argument count or -1], with the names of [MS-XLS]
+2.5.198.17 Ftab and the argument counts of OpenOffice.org's Excel file format
+documentation, 3.11.
+
+usage, from crates/exav-render:
+python3 -I scripts/office/sheets/ftab.py scripts/office/sheets/ftab.json > src/formats/office/sheets/xls/ftab.rs
+"""
+import json
+import sys
+
+rows = sorted(json.load(open(sys.argv[1])), key=lambda r: r[0])
+print("// Generated by scripts/office/sheets/ftab.py from ftab.json. Do not edit.")
+print()
+print("/// (BIFF function index, name, fixed argument count or -1), by index.")
+print("#[rustfmt::skip]")
+print("pub(crate) const FTAB: &[(u16, &str, i8)] = &[")
+for i, name, n in rows:
+ print(f' ({i}, "{name}", {n}),')
+print("];")
diff --git a/crates/exav-render/scripts/office/sheets/numbers_fonts.py b/crates/exav-render/scripts/office/sheets/numbers_fonts.py
new file mode 100644
index 0000000..476e46b
--- /dev/null
+++ b/crates/exav-render/scripts/office/sheets/numbers_fonts.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Writes src/formats/office/sheets/numbers/fonts.rs: the PostScript names of
+macOS fonts whose family the rule in style::family (split at '-', drop an MT
+or PSMT suffix, a space before each capital that follows a lower-case letter)
+gets wrong, from numbers-parser's src/numbers_parser/generated/fontmap.py
+(MIT, Jon Connell).
+
+usage, from crates/exav-render:
+python3 -I scripts/office/sheets/numbers_fonts.py fontmap.py > src/formats/office/sheets/numbers/fonts.rs
+"""
+import ast
+import sys
+
+text = open(sys.argv[1]).read()
+fonts = ast.literal_eval(text[text.index("{"):])
+
+
+def rule(ps):
+ base = ps.split("-", 1)[0]
+ for suffix in ("PSMT", "MT"):
+ if base.endswith(suffix):
+ base = base[: -len(suffix)]
+ break
+ out = ""
+ prev_lower = False
+ for c in base:
+ if c.isupper() and prev_lower:
+ out += " "
+ prev_lower = c.islower()
+ out += c
+ return out
+
+
+rows = sorted((ps, v["family"]) for ps, v in fonts.items() if rule(ps) != v["family"])
+print("// Generated by scripts/office/sheets/numbers_fonts.py from numbers-parser's")
+print("// fontmap.py (MIT, Jon Connell). Do not edit.")
+print()
+print("/// (PostScript name, family), by name.")
+print("#[rustfmt::skip]")
+print("pub(crate) const FAMILIES: &[(&str, &str)] = &[")
+for ps, fam in rows:
+ print(f' ({ps!r}, {fam!r}),'.replace("'", '"'))
+print("];")
diff --git a/crates/exav-render/scripts/office/sheets/numbers_functions.py b/crates/exav-render/scripts/office/sheets/numbers_functions.py
new file mode 100644
index 0000000..25d91af
--- /dev/null
+++ b/crates/exav-render/scripts/office/sheets/numbers_functions.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Writes src/formats/office/sheets/numbers/functions.rs, Numbers' function
+indexes (the AST_function_node_index of TSCE formula nodes) to their names,
+from numbers-parser's src/numbers_parser/generated/functionmap.py (MIT, Jon
+Connell), which maps them from the iWork applications.
+
+usage, from crates/exav-render:
+python3 -I scripts/office/sheets/numbers_functions.py functionmap.py > src/formats/office/sheets/numbers/functions.rs
+"""
+import re
+import sys
+
+text = open(sys.argv[1]).read()
+rows = sorted((int(k), v) for k, v in re.findall(r'^\s*(\d+):\s*"([A-Z0-9.]+)"', text, re.M))
+print("// Generated by scripts/office/sheets/numbers_functions.py from numbers-parser's")
+print("// functionmap.py (MIT, Jon Connell). Do not edit.")
+print()
+print("/// (function index, name), by index.")
+print("#[rustfmt::skip]")
+print("pub(crate) const FUNCTIONS: &[(u32, &str)] = &[")
+for k, v in rows:
+ print(f' ({k}, "{v}"),')
+print("];")
diff --git a/crates/exav-render/src/formats/cad/dwg/blocks.rs b/crates/exav-render/src/formats/cad/dwg/blocks.rs
index 2b3da90..c66d6a1 100644
--- a/crates/exav-render/src/formats/cad/dwg/blocks.rs
+++ b/crates/exav-render/src/formats/cad/dwg/blocks.rs
@@ -74,12 +74,19 @@ pub(crate) fn read(ctx: &mut Ctx<'_, '_>, vars: &Vars) -> Vec {
}
}
}
- ctx.names.insert(h, block.name.clone());
if block.end_handle.0 != 0 {
let _ = typed(ctx, block.end_handle.0, ENDBLK, "ENDBLK");
}
- records.push(rec);
+ records.push((h, rec));
}
+ number_anonymous(&mut records);
+ let records: Vec = records
+ .into_iter()
+ .map(|(h, rec)| {
+ ctx.names.insert(h, rec.block.name.clone());
+ rec
+ })
+ .collect();
let mut out = Vec::new();
for rec in records {
let mut block = rec.block;
@@ -112,6 +119,33 @@ pub(crate) fn read(ctx: &mut Ctx<'_, '_>, vars: &Vars) -> Vec {
out
}
+/// AutoCAD's files can keep an anonymous block's name without its number in
+/// both its record and its BLOCK entity: several `*U` blocks, each named by
+/// its inserts, and found by that name. Each gets a number past the highest
+/// one the drawing has, as AutoCAD numbers them when it loads the file.
+fn number_anonymous(records: &mut [(u64, Record)]) {
+ let bare = |n: &str| matches!(n.as_bytes(), [b'*', c] if c.is_ascii_alphabetic());
+ let mut next = records
+ .iter()
+ .filter_map(|(_, r)| {
+ let n = &r.block.name;
+ let digits = n
+ .trim_start_matches('*')
+ .trim_start_matches(|c: char| c.is_ascii_alphabetic());
+ (n.starts_with('*') && !digits.is_empty())
+ .then(|| digits.parse::().ok())
+ .flatten()
+ })
+ .max()
+ .unwrap_or(0);
+ for (_, r) in records.iter_mut() {
+ if bare(&r.block.name) {
+ next = next.saturating_add(1);
+ r.block.name = format!("{}{next}", r.block.name);
+ }
+ }
+}
+
/// A layout's viewports have no number or status in DWG (spec 20.4.38),
/// which DXF has (69, 68). As the converter writes them: an on viewport's
/// number is its place among the layout's viewports from 1 and its status
@@ -556,6 +590,52 @@ fn common(ctx: &mut Ctx<'_, '_>, vars: &Vars, o: &Object<'_>, record: Handle) ->
mod tests {
use super::*;
+ /// Inserts find their block by name, so two blocks named `*U` drew the
+ /// first one for both (AutoCAD's blocks_and_tables sample).
+ #[test]
+ fn bare_anonymous_names_are_numbered_past_the_highest() {
+ let mut records: Vec<(u64, Record)> = [
+ "*Model_Space",
+ "*Paper_Space0",
+ "*U2",
+ "*U",
+ "*U",
+ "*D",
+ "*B12",
+ ]
+ .iter()
+ .map(|n| {
+ let block = Block {
+ name: (*n).to_string(),
+ ..Block::default()
+ };
+ (
+ 0,
+ Record {
+ block,
+ first: 0,
+ last: 0,
+ owned: Vec::new(),
+ },
+ )
+ })
+ .collect();
+ number_anonymous(&mut records);
+ let names: Vec<&str> = records.iter().map(|(_, r)| r.block.name.as_str()).collect();
+ assert_eq!(
+ names,
+ [
+ "*Model_Space",
+ "*Paper_Space0",
+ "*U2",
+ "*U13",
+ "*U14",
+ "*D15",
+ "*B12"
+ ]
+ );
+ }
+
#[test]
fn the_spaces_have_their_names_whatever_the_release_wrote() {
for (written, read) in [
diff --git a/crates/exav-render/src/formats/cad/dwg/entities.rs b/crates/exav-render/src/formats/cad/dwg/entities.rs
index 4ea60c1..d325efd 100644
--- a/crates/exav-render/src/formats/cad/dwg/entities.rs
+++ b/crates/exav-render/src/formats/cad/dwg/entities.rs
@@ -153,6 +153,7 @@ pub(crate) fn read(
0x29 => return none(EntityKind::XLine(ray(o)?)),
0x2C => return none(EntityKind::MText(Box::new(mtext(ctx, o)?))),
0x2D => return none(EntityKind::Leader(Box::new(leader(ctx, o)?))),
+ 0x2E => return none(EntityKind::Tolerance(Box::new(tolerance(ctx, o)?))),
0x2F => return none(EntityKind::MLine(Box::new(mline(ctx, o)?))),
_ => {}
}
@@ -169,6 +170,7 @@ pub(crate) fn read(
}
"MULTILEADER" => none(EntityKind::MultiLeader(Box::new(multileader(ctx, o)?))),
"HELIX" => none(EntityKind::Helix(Box::new(helix(ctx, o)?))),
+ "MESH" => none(EntityKind::Mesh(Box::new(mesh(ctx, o)?))),
"ACAD_TABLE" => none(EntityKind::Table(Box::new(table(ctx, o)?))),
"PDFUNDERLAY" => none(EntityKind::Underlay(Box::new(underlay(
ctx,
@@ -401,6 +403,60 @@ fn quad(o: &mut Object<'_>, v: Version) -> BitResult {
})
}
+/// TOLERANCE: R13 and R14 a BS, the height and the gap (BD each), not
+/// kept; then the
+/// insertion, direction and extrusion (3BD each), the text (TV), and the
+/// dimension style in the handle stream.
+fn tolerance(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
+ let b = &mut o.data;
+ if ctx.version < Version::R2000 {
+ b.bs()?;
+ b.bd()?;
+ b.bd()?;
+ }
+ let mut t = Tolerance {
+ insertion: v3(b.bd3()?),
+ x_direction: v3(b.bd3()?),
+ extrusion: v3(b.bd3()?),
+ ..Tolerance::default()
+ };
+ t.text = string(ctx, o)?;
+ t.dimstyle = entry(ctx, o, "dimension style")?;
+ Ok(t)
+}
+
+/// MESH: BS version, B blend crease, BL subdivision level, BL vertex count
+/// and the vertices (3BD), BL face list length and the list (BL each), each
+/// face its count then its corners; the edges and creases after it are not
+/// read.
+fn mesh(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
+ let b = &mut o.data;
+ b.bs()?;
+ b.b()?;
+ b.bl()?;
+ let n = i64::from(b.bl()?);
+ let n = count(b, n, 6)?;
+ let mut m = Mesh::default();
+ for _ in 0..n {
+ let p = v3(o.data.bd3()?);
+ if ctx.room(m.vertices.len()) {
+ m.vertices.push(p);
+ }
+ }
+ let b = &mut o.data;
+ let n = i64::from(b.bl()?);
+ let n = count(b, n, 2)?;
+ let mut list = Vec::new();
+ for _ in 0..n {
+ let k = i64::from(o.data.bl()?);
+ if ctx.room(list.len()) {
+ list.push(k);
+ }
+ }
+ m.faces = Mesh::faces_from_list(&list, m.vertices.len());
+ Ok(m)
+}
+
fn face3d(o: &mut Object<'_>, v: Version) -> BitResult {
let b = &mut o.data;
let mut f = Face3D::default();
@@ -599,6 +655,9 @@ fn insert(
let block = o.handle_ref()?;
i.block_name = ctx.name(block).unwrap_or_default().to_string();
let f = followers(o, v, has_attribs, n)?;
+ if o.xdictionary != 0 {
+ i.clip = super::objects::insert_clip(ctx, o.xdictionary);
+ }
Ok((i, f))
}
@@ -1662,8 +1721,12 @@ fn viewport(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
}
let frozen = count(&o.handles, frozen, 8)?;
for _ in 0..frozen {
+ // AutoCAD's files can hold null references here, which name no
+ // layer and which DXF leaves out.
let h = o.handle_ref()?;
- push(ctx, &mut p.frozen_layers, Handle(h));
+ if h != 0 {
+ push(ctx, &mut p.frozen_layers, Handle(h));
+ }
}
p.clip_boundary = Handle(o.handle_ref()?);
Ok(p)
diff --git a/crates/exav-render/src/formats/cad/dwg/header.rs b/crates/exav-render/src/formats/cad/dwg/header.rs
index 7bb0fdf..28283a9 100644
--- a/crates/exav-render/src/formats/cad/dwg/header.rs
+++ b/crates/exav-render/src/formats/cad/dwg/header.rs
@@ -438,8 +438,11 @@ fn variables(s: &mut HeaderStreams<'_>, v: Version, vars: &mut Vars) -> BitResul
}
if r2004 {
// SORTENTS, INDEXCTL, HIDETEXT, XCLIPFRAME, DIMASSOC, HALOGAP
- for _ in 0..6 {
- s.data.rc()?;
+ for i in 0..6 {
+ let x = s.data.rc()?;
+ if i == 3 {
+ vars.header.xclipframe = i16::from(x);
+ }
}
// OBSCUREDCOLOR, INTERSECTIONCOLOR
skip_bs(s, 2)?;
diff --git a/crates/exav-render/src/formats/cad/dwg/objects.rs b/crates/exav-render/src/formats/cad/dwg/objects.rs
index bdcce72..de47821 100644
--- a/crates/exav-render/src/formats/cad/dwg/objects.rs
+++ b/crates/exav-render/src/formats/cad/dwg/objects.rs
@@ -243,6 +243,67 @@ pub(crate) fn annotative_columns(ctx: &mut Ctx<'_, '_>, xdictionary: u64) -> Opt
first.flatten()
}
+/// An insert's XCLIP boundary: its extension dictionary's ACAD_FILTER
+/// dictionary, whose SPATIAL entry is a SPATIAL_FILTER: BS
+/// count (70), 2RD points (10), 3BD extrusion (210), 3BD origin (11), BS
+/// display boundary (71), BS front clip on (72) and BD distance (40) when
+/// set, the same for the back (73, 41), then the inverse insert matrix and
+/// the clip boundary's, 12BD each (40).
+pub(crate) fn insert_clip(ctx: &mut Ctx<'_, '_>, xdictionary: u64) -> Option {
+ let entry = |entries: Vec<(String, Handle)>, name: &str| {
+ entries
+ .into_iter()
+ .find(|(n, _)| n.eq_ignore_ascii_case(name))
+ .map(|(_, h)| h)
+ };
+ let acad = entry(entries_of(ctx, xdictionary), "ACAD_FILTER")?;
+ let spatial = entry(entries_of(ctx, acad.0), "SPATIAL")?;
+ let mut o = ctx.object(spatial.0, "spatial filter")?;
+ if ctx.dwg.type_name(o.type_code).as_deref() != Some("SPATIAL_FILTER") {
+ return None;
+ }
+ match spatial_filter(ctx, &mut o) {
+ Ok(c) => c,
+ Err(e) => {
+ ctx.warn(
+ WarningKind::Malformed,
+ format!("spatial filter {:X} could not be read: {e}", spatial.0),
+ );
+ None
+ }
+ }
+}
+
+fn spatial_filter(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult> {
+ let b = &mut o.data;
+ let n = i64::from(b.bs()?);
+ let n = count(n, b.remaining(), 128)?;
+ let mut points = Vec::new();
+ for _ in 0..n {
+ let p = v2(b.rd2()?);
+ if ctx.room(points.len()) {
+ points.push(p);
+ }
+ }
+ b.bd3()?; // extrusion
+ b.bd3()?; // origin
+ let enabled = b.bs()? != 0;
+ if b.bs()? != 0 {
+ b.bd()?; // front distance
+ }
+ if b.bs()? != 0 {
+ b.bd()?; // back distance
+ }
+ let mut inverse = [0.0; 12];
+ for m in &mut inverse {
+ *m = b.bd()?;
+ }
+ if points.len() < 2 {
+ return Ok(None);
+ }
+ Ok(Some(InsertClip::from_filter(&points, &inverse, enabled)))
+}
+
/// An ACDB_MTEXTOBJECTCONTEXTDATA_CLASS object: whether it is the default
/// context, and its columns.
fn mtext_context(
diff --git a/crates/exav-render/src/formats/cad/dwg/tables.rs b/crates/exav-render/src/formats/cad/dwg/tables.rs
index 2c46cff..aeb3bcf 100644
--- a/crates/exav-render/src/formats/cad/dwg/tables.rs
+++ b/crates/exav-render/src/formats/cad/dwg/tables.rs
@@ -421,9 +421,8 @@ fn dim_style(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
for _ in 0..11 {
b.b()?;
}
- // DIMALTD, DIMZIN
- b.rc()?;
- b.rc()?;
+ b.rc()?; // DIMALTD
+ s.dimzin = i16::from(b.rc()?);
// DIMSD1, DIMSD2
b.b()?;
b.b()?;
@@ -432,12 +431,17 @@ fn dim_style(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
b.rc()?;
}
b.b()?; // DIMUPT
- // DIMTZIN, DIMALTZ, DIMALTTZ, DIMTAD
- for _ in 0..4 {
+ // DIMTZIN, DIMALTZ, DIMALTTZ
+ for _ in 0..3 {
b.rc()?;
}
- // DIMUNIT, DIMAUNIT, DIMDEC, DIMTDEC, DIMALTU, DIMALTTD
- for _ in 0..6 {
+ s.dimtad = i16::from(b.rc()?);
+ // DIMUNIT, DIMAUNIT
+ b.bs()?;
+ b.bs()?;
+ s.dimdec = b.bs()?;
+ // DIMTDEC, DIMALTU, DIMALTTD
+ for _ in 0..3 {
b.bs()?;
}
s.dimscale = b.bd()?;
@@ -453,10 +457,11 @@ fn dim_style(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
s.dimtxt = b.bd()?;
b.bd()?; // DIMCEN
s.dimtsz = b.bd()?;
- // DIMALTF, DIMLFAC, DIMTVP, DIMTFAC
- for _ in 0..4 {
- b.bd()?;
- }
+ b.bd()?; // DIMALTF
+ s.dimlfac = b.bd()?;
+ // DIMTVP, DIMTFAC
+ b.bd()?;
+ b.bd()?;
s.dimgap = b.bd()?;
// DIMPOST, DIMAPOST, DIMBLK, DIMBLK1, DIMBLK2
for _ in 0..5 {
@@ -497,20 +502,20 @@ fn dim_style(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
for _ in 0..6 {
b.b()?;
}
- // DIMTAD, DIMZIN, DIMAZIN
- for _ in 0..3 {
- b.bs()?;
- }
+ s.dimtad = b.bs()?;
+ s.dimzin = b.bs()?;
+ b.bs()?; // DIMAZIN
if ctx.version >= Version::R2007 {
b.bs()?; // DIMARCSYM
}
s.dimtxt = b.bd()?;
b.bd()?; // DIMCEN
s.dimtsz = b.bd()?;
- // DIMALTF, DIMLFAC, DIMTVP, DIMTFAC
- for _ in 0..4 {
- b.bd()?;
- }
+ b.bd()?; // DIMALTF
+ s.dimlfac = b.bd()?;
+ // DIMTVP, DIMTFAC
+ b.bd()?;
+ b.bd()?;
s.dimgap = b.bd()?;
b.bd()?; // DIMALTRND
b.b()?; // DIMALT
@@ -523,11 +528,16 @@ fn dim_style(ctx: &mut Ctx<'_, '_>, o: &mut Object<'_>) -> BitResult {
s.dimclre = cmc(o, ctx.version)?.0;
s.dimclrt = cmc(o, ctx.version)?.0;
let b = &mut o.data;
- // DIMADEC, DIMDEC, DIMTDEC, DIMALTU, DIMALTTD, DIMAUNIT, DIMFRAC,
- // DIMLUNIT, DIMDSEP, DIMTMOVE, DIMJUST
- for _ in 0..11 {
+ s.dimadec = b.bs()?;
+ s.dimdec = b.bs()?;
+ // DIMTDEC, DIMALTU, DIMALTTD, DIMAUNIT, DIMFRAC, DIMLUNIT
+ for _ in 0..6 {
b.bs()?;
}
+ s.dimdsep = b.bs()?;
+ // DIMTMOVE, DIMJUST
+ b.bs()?;
+ b.bs()?;
// DIMSD1, DIMSD2
b.b()?;
b.b()?;
diff --git a/crates/exav-render/src/formats/cad/dxf/build.rs b/crates/exav-render/src/formats/cad/dxf/build.rs
index 69a8fe8..0c58263 100644
--- a/crates/exav-render/src/formats/cad/dxf/build.rs
+++ b/crates/exav-render/src/formats/cad/dxf/build.rs
@@ -317,6 +317,27 @@ pub(crate) fn build(mut raw: Raw, ctx: Ctx<'_>) -> Drawing {
}
}
+ // An insert's clipping boundary: its extension dictionary's ACAD_FILTER
+ // dictionary, whose SPATIAL entry is the filter.
+ if !ctx.insert_dictionaries.is_empty() {
+ let dictionaries: HashMap =
+ raw.dictionaries.iter().map(|d| (d.handle, d)).collect();
+ let filter_of = |xdict: u64| -> Option {
+ let acad = dictionaries.get(&Handle(xdict))?.get("ACAD_FILTER")?;
+ let spatial = dictionaries.get(&acad)?.get("SPATIAL")?;
+ ctx.spatial_filters.get(&spatial.0).cloned()
+ };
+ for b in &mut blocks {
+ for e in &mut b.entities {
+ if let EntityKind::Insert(ins) = &mut e.kind {
+ if let Some(&x) = ctx.insert_dictionaries.get(&e.handle.0) {
+ ins.clip = filter_of(x);
+ }
+ }
+ }
+ }
+ }
+
Drawing {
header: raw.header,
layers: raw.layers,
diff --git a/crates/exav-render/src/formats/cad/dxf/entities.rs b/crates/exav-render/src/formats/cad/dxf/entities.rs
index 2950ef6..3c9cef0 100644
--- a/crates/exav-render/src/formats/cad/dxf/entities.rs
+++ b/crates/exav-render/src/formats/cad/dxf/entities.rs
@@ -92,6 +92,20 @@ fn plane(p: &mut Plane, t: &Tag<'_>) -> bool {
p3(&mut p.extrusion, t, 210)
}
+/// A record's extension dictionary: group 360 of its `{ACAD_XDICTIONARY`
+/// application group, which `Parts` sets aside.
+fn xdictionary(tags: &[Tag<'_>]) -> Option {
+ let start = tags
+ .iter()
+ .position(|t| t.code == 102 && t.is("{ACAD_XDICTIONARY"))?;
+ tags.get(start + 1..)?
+ .iter()
+ .take_while(|t| t.code != 102)
+ .find(|t| t.code == 360)
+ .map(|t| t.handle())
+ .filter(|h| *h != 0)
+}
+
pub(crate) fn entity(rec: &Record<'_>, ctx: &mut Ctx<'_>) -> Entity {
let parts = Parts::new(&rec.tags, false);
let mut e = Entity {
@@ -114,10 +128,17 @@ pub(crate) fn entity(rec: &Record<'_>, ctx: &mut Ctx<'_>) -> Entity {
"SOLID" => EntityKind::Solid(quad(data)),
"TRACE" => EntityKind::Trace(quad(data)),
"3DFACE" => EntityKind::Face3D(face3d(data)),
+ "MESH" => EntityKind::Mesh(Box::new(mesh(data, ctx))),
+ "TOLERANCE" => EntityKind::Tolerance(Box::new(tolerance(data, ctx))),
"TEXT" => EntityKind::Text(Box::new(text(data, false, ctx).0)),
"ATTRIB" => EntityKind::Attribute(Box::new(attribute(&parts, data, ctx))),
"ATTDEF" => EntityKind::AttributeDefinition(Box::new(attribute(&parts, data, ctx))),
- "INSERT" => EntityKind::Insert(Box::new(insert(data, ctx))),
+ "INSERT" => {
+ if let Some(d) = xdictionary(&rec.tags) {
+ ctx.insert_dictionaries.insert(e.handle.0, d);
+ }
+ EntityKind::Insert(Box::new(insert(data, ctx)))
+ }
"MTEXT" => {
let mut m = mtext(data, ctx);
if m.columns.is_none() {
@@ -436,6 +457,81 @@ fn quad(data: &[Tag<'_>]) -> Quad {
q
}
+/// MESH: its level 0 cage, 92 vertices (10, 20, 30) and a face list of 93
+/// values (90), each face its corner count then its corners; the edges
+/// (94), creases (95) and overrides after it are not read.
+fn mesh(data: &[Tag<'_>], ctx: &mut Ctx<'_>) -> Mesh {
+ #[derive(PartialEq)]
+ enum At {
+ Head,
+ Vertices,
+ Faces(usize),
+ Tail,
+ }
+ let mut m = Mesh::default();
+ let mut list: Vec = Vec::new();
+ let mut at = At::Head;
+ for t in data {
+ match (&at, t.code) {
+ (At::Head, 92) => at = At::Vertices,
+ (At::Vertices, 10) => {
+ if ctx.room(m.vertices.len()) {
+ m.vertices.push(Vec3::new(t.f64(), 0.0, 0.0));
+ }
+ }
+ (At::Vertices, 20) => {
+ if let Some(v) = m.vertices.last_mut() {
+ v.y = t.f64();
+ }
+ }
+ (At::Vertices, 30) => {
+ if let Some(v) = m.vertices.last_mut() {
+ v.z = t.f64();
+ }
+ }
+ (At::Head | At::Vertices, 93) => {
+ let n = usize::try_from(t.int()).unwrap_or(0);
+ at = if n > 0 { At::Faces(n) } else { At::Tail };
+ }
+ (At::Faces(left), 90) => {
+ let left = *left;
+ if ctx.room(list.len()) {
+ list.push(t.int());
+ }
+ at = if left > 1 {
+ At::Faces(left - 1)
+ } else {
+ At::Tail
+ };
+ }
+ (_, 94) => at = At::Tail,
+ _ => {}
+ }
+ }
+ m.faces = Mesh::faces_from_list(&list, m.vertices.len());
+ m
+}
+
+/// TOLERANCE: insertion (10), direction (11), extrusion (210), text (1),
+/// dimension style (3).
+fn tolerance(data: &[Tag<'_>], ctx: &mut Ctx<'_>) -> Tolerance {
+ let mut x = Tolerance::default();
+ for t in data {
+ if p3(&mut x.insertion, t, 10)
+ || p3(&mut x.x_direction, t, 11)
+ || p3(&mut x.extrusion, t, 210)
+ {
+ continue;
+ }
+ match t.code {
+ 1 => x.text = ctx.text(t),
+ 3 => x.dimstyle = ctx.text(t),
+ _ => {}
+ }
+ }
+ x
+}
+
fn face3d(data: &[Tag<'_>]) -> Face3D {
let mut f = Face3D::default();
let mut fourth = false;
diff --git a/crates/exav-render/src/formats/cad/dxf/header.rs b/crates/exav-render/src/formats/cad/dxf/header.rs
index 18aa11d..ceabc72 100644
--- a/crates/exav-render/src/formats/cad/dxf/header.rs
+++ b/crates/exav-render/src/formats/cad/dxf/header.rs
@@ -106,6 +106,7 @@ pub(crate) fn read(tags: &[Tag<'_>], raw: &mut Raw, ctx: &mut Ctx<'_>) {
"$LWDISPLAY" => h.lwdisplay = v.bool(),
"$FILLMODE" => h.fillmode = v.bool(),
"$MIRRTEXT" => h.mirrtext = v.bool(),
+ "$XCLIPFRAME" => h.xclipframe = v.i16(),
_ => {}
}
}
diff --git a/crates/exav-render/src/formats/cad/dxf/mod.rs b/crates/exav-render/src/formats/cad/dxf/mod.rs
index 9f750e6..87a1f04 100644
--- a/crates/exav-render/src/formats/cad/dxf/mod.rs
+++ b/crates/exav-render/src/formats/cad/dxf/mod.rs
@@ -64,6 +64,11 @@ pub(crate) struct Ctx<'l> {
/// Layer names and handles, once the tables are read: R12 viewports
/// name their frozen layers.
pub layer_handles: Vec<(String, Handle)>,
+ /// Each INSERT's extension dictionary, by the insert's handle: where its
+ /// clipping boundary is found once the objects are read.
+ pub insert_dictionaries: std::collections::HashMap,
+ /// SPATIAL_FILTER objects, by handle.
+ pub spatial_filters: std::collections::HashMap,
}
impl<'l> Ctx<'l> {
@@ -79,6 +84,8 @@ impl<'l> Ctx<'l> {
entity_limit_hit: false,
item_limit_hit: false,
layer_handles: Vec::new(),
+ insert_dictionaries: Default::default(),
+ spatial_filters: Default::default(),
}
}
diff --git a/crates/exav-render/src/formats/cad/dxf/objects.rs b/crates/exav-render/src/formats/cad/dxf/objects.rs
index 26c1083..3f83164 100644
--- a/crates/exav-render/src/formats/cad/dxf/objects.rs
+++ b/crates/exav-render/src/formats/cad/dxf/objects.rs
@@ -46,6 +46,42 @@ pub(crate) fn object(rec: &Record<'_>, raw: &mut Raw, ctx: &mut Ctx<'_>) {
raw.dictionaries.push(d);
}
"LAYOUT" => raw.layouts.push(layout(&parts, handle, ctx)),
+ // An XCLIP boundary: its points (10), clipping on (71), then two
+ // matrices of 12 (40), the inverse insert matrix and the clip
+ // boundary's; the front and back distances are 40 and 41 before
+ // them, so the matrices are the last 24 of the 40s.
+ "SPATIAL_FILTER" => {
+ let mut points: Vec = Vec::new();
+ let mut forties: Vec = Vec::new();
+ let mut enabled = true;
+ for t in class(&parts, "AcDbSpatialFilter") {
+ match t.code {
+ 10 => {
+ if ctx.room(points.len()) {
+ points.push(Vec2::new(t.f64(), 0.0));
+ }
+ }
+ 20 => {
+ if let Some(p) = points.last_mut() {
+ p.y = t.f64();
+ }
+ }
+ 71 => enabled = t.bool(),
+ 40 if ctx.room(forties.len()) => forties.push(t.f64()),
+ _ => {}
+ }
+ }
+ let at = forties.len().saturating_sub(24);
+ let inverse = forties
+ .get(at..at + 12)
+ .and_then(|m| <[f64; 12]>::try_from(m).ok());
+ if let (Some(inverse), true) = (inverse, forties.len() >= 24 && points.len() >= 2) {
+ ctx.spatial_filters.insert(
+ handle.0,
+ InsertClip::from_filter(&points, &inverse, enabled),
+ );
+ }
+ }
"SORTENTSTABLE" => {
let mut s = SortEntsTable {
handle,
diff --git a/crates/exav-render/src/formats/cad/dxf/tables.rs b/crates/exav-render/src/formats/cad/dxf/tables.rs
index b6cbca8..fc26f30 100644
--- a/crates/exav-render/src/formats/cad/dxf/tables.rs
+++ b/crates/exav-render/src/formats/cad/dxf/tables.rs
@@ -195,6 +195,12 @@ fn dim_style(parts: &Parts<'_>, handle: Handle, ctx: &mut Ctx<'_>) -> DimStyle {
140 => d.dimtxt = t.f64(),
142 => d.dimtsz = t.f64(),
147 => d.dimgap = t.f64(),
+ 77 => d.dimtad = t.i16(),
+ 78 => d.dimzin = t.i16(),
+ 144 => d.dimlfac = t.f64(),
+ 271 => d.dimdec = t.i16(),
+ 179 => d.dimadec = t.i16(),
+ 278 => d.dimdsep = t.i16(),
176 => d.dimclrd = Color::from_aci(t.int()),
177 => d.dimclre = Color::from_aci(t.int()),
178 => d.dimclrt = Color::from_aci(t.int()),
diff --git a/crates/exav-render/src/formats/cad/json.rs b/crates/exav-render/src/formats/cad/json.rs
index f29aad5..ed42bb0 100644
--- a/crates/exav-render/src/formats/cad/json.rs
+++ b/crates/exav-render/src/formats/cad/json.rs
@@ -340,6 +340,7 @@ fn header(o: &mut Obj<'_>, h: &Header) {
o.b("lwdisplay", h.lwdisplay);
o.b("fillmode", h.fillmode);
o.b("mirrtext", h.mirrtext);
+ o.i("xclipframe", h.xclipframe);
}
fn layer(o: &mut Obj<'_>, l: &Layer) {
@@ -401,6 +402,12 @@ fn dim_style(o: &mut Obj<'_>, d: &DimStyle) {
o.f("dimtsz", d.dimtsz);
o.f("dimtxt", d.dimtxt);
o.f("dimgap", d.dimgap);
+ o.i("dimtad", d.dimtad);
+ o.i("dimzin", d.dimzin);
+ o.f("dimlfac", d.dimlfac);
+ o.i("dimdec", d.dimdec);
+ o.i("dimadec", d.dimadec);
+ o.i("dimdsep", d.dimdsep);
o.color("dimclrd", d.dimclrd);
o.color("dimclre", d.dimclre);
o.color("dimclrt", d.dimclrt);
@@ -947,6 +954,26 @@ fn kind(o: &mut Obj<'_>, k: &EntityKind) {
o.v3s("corners", &f.corners);
o.i("invisible_edges", f.invisible_edges);
}
+ EntityKind::Mesh(m) => {
+ o.v3s("vertices", &m.vertices);
+ o.list("faces", &m.faces, |s, f| {
+ s.push('[');
+ for (n, i) in f.iter().enumerate() {
+ if n > 0 {
+ s.push(',');
+ }
+ let _ = write!(s, "{i}");
+ }
+ s.push(']');
+ });
+ }
+ EntityKind::Tolerance(t) => {
+ o.v3("insertion", t.insertion);
+ o.v3("x_direction", t.x_direction);
+ o.v3("extrusion", t.extrusion);
+ o.str("text", &t.text);
+ o.str("dimstyle", &t.dimstyle);
+ }
EntityKind::Text(t) => text(o, t),
EntityKind::Attribute(a) | EntityKind::AttributeDefinition(a) => attribute(o, a),
EntityKind::Insert(i) => {
@@ -960,6 +987,13 @@ fn kind(o: &mut Obj<'_>, k: &EntityKind) {
o.f("row_spacing", i.row_spacing);
o.v3("extrusion", i.extrusion);
o.objects("attributes", &i.attributes, entity);
+ match &i.clip {
+ Some(c) => o.object("clip", |o| {
+ o.v2s("boundary", &c.boundary);
+ o.b("enabled", c.enabled);
+ }),
+ None => o.null("clip"),
+ }
}
EntityKind::MText(m) => mtext(o, m),
EntityKind::Dimension(d) => {
diff --git a/crates/exav-render/src/formats/cad/model.rs b/crates/exav-render/src/formats/cad/model.rs
index 136633a..c2b8d24 100644
--- a/crates/exav-render/src/formats/cad/model.rs
+++ b/crates/exav-render/src/formats/cad/model.rs
@@ -244,6 +244,8 @@ pub struct Header {
pub lwdisplay: bool,
pub fillmode: bool,
pub mirrtext: bool,
+ /// `$XCLIPFRAME`: 0 hidden, 1 shown and plotted, 2 shown only.
+ pub xclipframe: i16,
}
impl Default for Header {
@@ -286,6 +288,7 @@ impl Default for Header {
lwdisplay: false,
fillmode: true,
mirrtext: false,
+ xclipframe: 2,
}
}
}
diff --git a/crates/exav-render/src/formats/cad/model/entity.rs b/crates/exav-render/src/formats/cad/model/entity.rs
index 60ed8f8..5fd3d84 100644
--- a/crates/exav-render/src/formats/cad/model/entity.rs
+++ b/crates/exav-render/src/formats/cad/model/entity.rs
@@ -68,6 +68,7 @@ pub enum EntityKind {
Leader(Box),
Line(Line),
LwPolyline(LwPolyline),
+ Mesh(Box),
MLine(Box),
MText(Box),
MultiLeader(Box),
@@ -80,6 +81,7 @@ pub enum EntityKind {
Spline(Box),
Table(Box
),
Text(Box),
+ Tolerance(Box),
Trace(Quad),
Underlay(Box),
Viewport(Box),
@@ -106,6 +108,7 @@ impl EntityKind {
EntityKind::Leader(_) => "LEADER",
EntityKind::Line(_) => "LINE",
EntityKind::LwPolyline(_) => "LWPOLYLINE",
+ EntityKind::Mesh(_) => "MESH",
EntityKind::MLine(_) => "MLINE",
EntityKind::MText(_) => "MTEXT",
EntityKind::MultiLeader(_) => "MULTILEADER",
@@ -118,6 +121,7 @@ impl EntityKind {
EntityKind::Spline(_) => "SPLINE",
EntityKind::Table(_) => "ACAD_TABLE",
EntityKind::Text(_) => "TEXT",
+ EntityKind::Tolerance(_) => "TOLERANCE",
EntityKind::Trace(_) => "TRACE",
EntityKind::Underlay(u) => match u.kind {
UnderlayKind::Pdf => "PDFUNDERLAY",
@@ -412,6 +416,63 @@ pub struct Quad {
pub plane: Plane,
}
+/// MESH (2010 on): a subdivision mesh's control cage, in world
+/// coordinates; its smoothed levels are not stored.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Mesh {
+ pub vertices: Vec,
+ /// Each face's vertex indices, from 0.
+ pub faces: Vec>,
+}
+
+impl Mesh {
+ /// The faces of a stored face list (each its corner count, then its
+ /// corners), those naming a vertex the mesh does not have left out.
+ pub fn faces_from_list(list: &[i64], vertices: usize) -> Vec> {
+ let mut faces = Vec::new();
+ let mut i = 0;
+ while let Some(&n) = list.get(i) {
+ let Ok(n) = usize::try_from(n) else { break };
+ let Some(ids) = list.get(i + 1..i + 1 + n) else {
+ break;
+ };
+ let face: Option> = ids
+ .iter()
+ .map(|&k| u32::try_from(k).ok().filter(|&k| (k as usize) < vertices))
+ .collect();
+ if let Some(face) = face.filter(|f| f.len() >= 2) {
+ faces.push(face);
+ }
+ i += n + 1;
+ }
+ faces
+ }
+}
+
+/// TOLERANCE: a feature control frame, its text in the GD&T font's codes
+/// (`{\Fgdt;j}`), `%%v` between its boxes and `^J` between its rows.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Tolerance {
+ pub insertion: Vec3,
+ pub x_direction: Vec3,
+ pub extrusion: Vec3,
+ pub text: String,
+ /// The dimension style: its text height, gap and colours.
+ pub dimstyle: String,
+}
+
+impl Default for Tolerance {
+ fn default() -> Self {
+ Tolerance {
+ insertion: Vec3::default(),
+ x_direction: Vec3::new(1.0, 0.0, 0.0),
+ extrusion: Vec3::Z,
+ text: String::new(),
+ dimstyle: String::new(),
+ }
+ }
+}
+
/// 3DFACE, in world coordinates.
#[derive(Clone, Debug, Default, PartialEq)]
pub struct Face3D {
@@ -548,6 +609,39 @@ pub struct Insert {
pub extrusion: Vec3,
/// The ATTRIB entities that follow it.
pub attributes: Vec,
+ /// Its clipping boundary (XCLIP), when it has one.
+ pub clip: Option,
+}
+
+/// An insert's clipping boundary: the SPATIAL_FILTER its extension
+/// dictionary names under ACAD_FILTER, then SPATIAL.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct InsertClip {
+ /// In the block's coordinates: the filter's points through its inverse
+ /// insert matrix. Two points are a rectangle's opposite corners.
+ pub boundary: Vec,
+ /// Group 71: clipping is on.
+ pub enabled: bool,
+}
+
+impl InsertClip {
+ /// The boundary from a filter's points and its inverse insert matrix,
+ /// 12 numbers by rows of 4 (x' = m0 x + m1 y + m2 z + m3, ...).
+ pub fn from_filter(points: &[Vec2], inverse: &[f64; 12], enabled: bool) -> InsertClip {
+ let m = inverse;
+ InsertClip {
+ boundary: points
+ .iter()
+ .map(|p| {
+ Vec2::new(
+ m[0] * p.x + m[1] * p.y + m[3],
+ m[4] * p.x + m[5] * p.y + m[7],
+ )
+ })
+ .collect(),
+ enabled,
+ }
+ }
}
impl Default for Insert {
@@ -563,6 +657,7 @@ impl Default for Insert {
row_spacing: 0.0,
extrusion: Vec3::Z,
attributes: Vec::new(),
+ clip: None,
}
}
}
diff --git a/crates/exav-render/src/formats/cad/model/tables.rs b/crates/exav-render/src/formats/cad/model/tables.rs
index bdafbfa..f0bb4da 100644
--- a/crates/exav-render/src/formats/cad/model/tables.rs
+++ b/crates/exav-render/src/formats/cad/model/tables.rs
@@ -162,6 +162,17 @@ pub struct DimStyle {
pub dimtsz: f64,
pub dimtxt: f64,
pub dimgap: f64,
+ /// Text above the dimension line (1 and up) or centred on it (0).
+ pub dimtad: i16,
+ /// Zero suppression: 4 leading, 8 trailing.
+ pub dimzin: i16,
+ /// Scale applied to linear measurements.
+ pub dimlfac: f64,
+ /// Decimal places of linear and of angular measurements.
+ pub dimdec: i16,
+ pub dimadec: i16,
+ /// The decimal separator's character code.
+ pub dimdsep: i16,
pub dimclrd: Color,
pub dimclre: Color,
pub dimclrt: Color,
@@ -190,6 +201,12 @@ impl Default for DimStyle {
dimtsz: 0.0,
dimtxt: 0.18,
dimgap: 0.09,
+ dimtad: 0,
+ dimzin: 0,
+ dimlfac: 1.0,
+ dimdec: 4,
+ dimadec: 0,
+ dimdsep: 46,
dimclrd: Color::ByBlock,
dimclre: Color::ByBlock,
dimclrt: Color::ByBlock,
diff --git a/crates/exav-render/src/formats/dwg/DESIGN.md b/crates/exav-render/src/formats/dwg/DESIGN.md
index b23e304..5fa28d8 100644
--- a/crates/exav-render/src/formats/dwg/DESIGN.md
+++ b/crates/exav-render/src/formats/dwg/DESIGN.md
@@ -71,11 +71,26 @@ entities.
| Fills | Hatch, Solid, Face3D, gradients | triangles: colour, layer id |
| Glyphs | Text, MText, Attribute in an outline face | instanced quads into a Canvas-built atlas |
-Curves are flattened at a tolerance chosen from the drawing's extents. Both
+Circles, arcs and bulged polyline segments are strokes too, when nothing
+dashes them and the transform keeps circles round: each carries a bulge, at
+most a quarter turn's, and the fragment shader measures the distance to the
+arc itself, so a curve is exact at any zoom. Other curves (ellipses,
+splines, dashed arcs, arcs in a block scaled unevenly) are flattened at a
+fixed sagitta of a thousandth of their radius, and an arc crossing a clip
+boundary is cut as its flattened pieces. Both
the stroke and fill buffers are sorted into spatial buckets recording the true
-box of their contents, so a view draws only the buckets it touches. Buckets
-are built within the opaque and the translucent halves, which are two passes
-(only the first writes depth).
+box of their contents, so a view draws only the buckets it touches. Only the
+opaque half is bucketed. The translucent half follows it in draw order, cut
+into tiles of consecutive entities, and is drawn after all opaque geometry,
+fills and strokes interleaved by draw order (`translucent_runs`). Both passes
+write depth, so an entity's overlaps with itself blend once. Text under
+translucent geometry is drawn in two parts: the glyphs' solid cores before
+the translucent pass, their edges after it.
+
+The context has no multisampling: strokes measure their own coverage. An
+opaque fill of one colour is outlined by strokes of no width (`FILL_EDGE`),
+whose fringe is the coverage of the pixels just outside it; drawn at the
+fill's depth, they are hidden wherever the fill is.
### 3.3 Layer show and hide without re-uploading
@@ -125,19 +140,28 @@ it into the view matrix.
|---|---|
| Lines, arcs, circles, ellipses, polylines, splines | Drawn |
| Blocks and inserts, nested, scaled, rotated, MINSERT arrays | Drawn, with a cycle guard |
-| Dimensions | Drawn from the anonymous block AutoCAD bakes |
+| Dimensions | Drawn from the anonymous block AutoCAD bakes; one saved without it from its definition points and style (`dimension.rs`: no DIMTIH, feet and inches, tolerances or alternate units) |
| MLINE, HELIX | Drawn |
| Layers: colour, on/off, freeze, transparency | From the file |
| Lineweight | Instanced quads, zoom-aware |
| Solid and gradient hatch, islands | Even-odd, holes bridged into the outer ring |
| Pattern hatch | Line families clipped to the region, with dash phase |
| Linetypes | Dashed in drawing units, phase carried along a polyline; LTSCALE, per-entity and block scale |
+| Complex linetypes | Their text; the shapes of ltypeshp.shx (AutoCAD's own TRACKS, ZIGZAG, FENCELINE1 and 2, BATTING), redrawn; other shape files' shapes left out |
| Extrusion (OCS) | Arbitrary Axis Algorithm, for the entity types stored in object coordinates |
-| TrueType text | Bundled faces, glyph atlas |
+| TrueType text | Bundled faces, glyph atlas sized to the view; distance fields when the character set is too large for that size |
| SHX text | Substituted, see 5.3 |
-| MTEXT formatting | Colour, height, font, the three rules, indents and tabs kept; stacked fractions as `a/b` |
+| MTEXT formatting | Colour, height, font, width factor, oblique, tracking, the three rules, indents, tabs, justification, stacks, background masks and frames |
+| Text placement | Mirrored and stretched with its block, TEXT's backward and upside-down flags, Bottom and Middle on the face's descender |
+| Symbol fonts | symbol.ttf, greeks/greekc.shx and gdt.shx as the characters they draw |
+| Characters the stroke font lacks (CJK) | The run drawn in the outline face, completed from the browser's fonts |
| Paper-space layouts and viewports | Drawn |
-| External references, images, OLE | Frame only; counted in the warnings |
+| External references, images, OLE | Xrefs: their path at the insertion point; images, underlays, OLE: frame only; all counted, with the files they name, in the warnings |
+| XCLIP | The block cut to its boundary, the frame as `$XCLIPFRAME` says |
+| Points | `$PDMODE` shapes, `$PDSIZE` (a share of the drawing's height when not in units) |
+| 3DFACE, polyface and polygon meshes, MESH | Their visible edges, in plan |
+| TOLERANCE | Feature control frame, GD&T symbols |
+| Leader arrowheads | The style's arrow block, else AutoCAD's built-in shape of that name |
| Custom objects (proxy graphics) | Drawn from the graphics saved with them, see 5.4; those saved without are counted in the warnings |
| Plot styles (CTB/STB) | Not planned |
diff --git a/crates/exav-render/src/formats/dwg/clip.rs b/crates/exav-render/src/formats/dwg/clip.rs
index 9d42dea..a7beb78 100644
--- a/crates/exav-render/src/formats/dwg/clip.rs
+++ b/crates/exav-render/src/formats/dwg/clip.rs
@@ -65,6 +65,17 @@ impl ClipShape {
})
}
+ /// The region as triangles.
+ pub fn triangles(&self) -> Vec<[[f64; 2]; 3]> {
+ match self {
+ ClipShape::Rect { min, max } => vec![
+ [[min[0], min[1]], [max[0], min[1]], [max[0], max[1]]],
+ [[min[0], min[1]], [max[0], max[1]], [min[0], max[1]]],
+ ],
+ ClipShape::Poly { pieces, .. } => pieces.clone(),
+ }
+ }
+
pub fn bounds(&self) -> ([f64; 2], [f64; 2]) {
match self {
ClipShape::Rect { min, max } => (*min, *max),
diff --git a/crates/exav-render/src/formats/dwg/curves.rs b/crates/exav-render/src/formats/dwg/curves.rs
index e43b56e..ba09271 100644
--- a/crates/exav-render/src/formats/dwg/curves.rs
+++ b/crates/exav-render/src/formats/dwg/curves.rs
@@ -4,8 +4,9 @@
use std::f64::consts::TAU;
/// Sagitta error target as a fraction of radius. 0.001 gives ~70 segments for a
-/// full circle, which holds up past the zoom levels a viewer reaches before
-/// re-tessellation would kick in.
+/// full circle. The curves that reach here are flattened once and never
+/// refined at a closer zoom; a circle, arc or bulge that nothing prevents is
+/// not flattened at all (see DESIGN.md).
const SAGITTA_RATIO: f64 = 0.001;
const MIN_SEGMENTS: usize = 8;
const MAX_SEGMENTS: usize = 512;
@@ -31,6 +32,58 @@ fn ccw_sweep(sweep: f64) -> Option {
Some(if s > 0.0 { s } else { TAU })
}
+/// The centre, radius and angles of the arc from `a` to `b` with this
+/// bulge: (cx, cy, r, start, signed sweep). None for a straight one.
+pub fn bulge_arc(a: [f64; 2], b: [f64; 2], bulge: f64) -> Option<(f64, f64, f64, f64, f64)> {
+ let chord = (b[0] - a[0]).hypot(b[1] - a[1]);
+ if bulge == 0.0 || !bulge.is_finite() || chord < 1e-12 {
+ return None;
+ }
+ let sweep = 4.0 * bulge.atan();
+ let r = chord / (2.0 * (sweep / 2.0).sin().abs());
+ // The centre lies off the chord's middle, to its left for a
+ // counter-clockwise arc under half a turn.
+ let (mx, my) = ((a[0] + b[0]) / 2.0, (a[1] + b[1]) / 2.0);
+ let (ux, uy) = ((b[0] - a[0]) / chord, (b[1] - a[1]) / chord);
+ let d = chord / 2.0 / (sweep / 2.0).tan();
+ let (cx, cy) = (mx - uy * d, my + ux * d);
+ let start = (a[1] - cy).atan2(a[0] - cx);
+ Some((cx, cy, r, start, sweep))
+}
+
+/// `n` + 1 points along the arc from `a` to `b` with this bulge.
+pub fn bulge_points(a: [f64; 2], b: [f64; 2], bulge: f64, n: usize) -> Vec<[f64; 2]> {
+ let Some((cx, cy, r, start, sweep)) = bulge_arc(a, b, bulge) else {
+ return vec![a, b];
+ };
+ let n = n.max(1);
+ let mut out: Vec<[f64; 2]> = (0..=n)
+ .map(|i| {
+ let t = start + sweep * i as f64 / n as f64;
+ [cx + r * t.cos(), cy + r * t.sin()]
+ })
+ .collect();
+ // The ends exactly where they were.
+ out[0] = a;
+ out[n] = b;
+ out
+}
+
+/// Sample a circular arc from `start` over a signed `sweep` (radians,
+/// positive counter-clockwise).
+pub fn arc_points(cx: f64, cy: f64, r: f64, start: f64, sweep: f64) -> Vec<[f64; 2]> {
+ if !r.is_finite() || r <= 0.0 || !sweep.is_finite() || !start.is_finite() {
+ return Vec::new();
+ }
+ let n = segments_for_sweep(sweep);
+ (0..=n)
+ .map(|i| {
+ let a = start + sweep * (i as f64 / n as f64);
+ [cx + r * a.cos(), cy + r * a.sin()]
+ })
+ .collect()
+}
+
/// Sample a circular arc counter-clockwise from `start` to `end` (radians).
pub fn flatten_arc(cx: f64, cy: f64, r: f64, start: f64, end: f64) -> Vec<[f64; 2]> {
if !r.is_finite() || r <= 0.0 {
@@ -529,6 +582,25 @@ mod tests {
((a[0] - b[0]).powi(2) + (a[1] - b[1]).powi(2)).sqrt()
}
+ #[test]
+ fn a_bulge_is_its_arc() {
+ let quarter = (PI / 8.0).tan();
+ // Counter-clockwise from (1,0) to (0,1): about the origin, radius 1.
+ let (cx, cy, r, start, sweep) = bulge_arc([1.0, 0.0], [0.0, 1.0], quarter).unwrap();
+ assert!(cx.abs() < 1e-12 && cy.abs() < 1e-12 && (r - 1.0).abs() < 1e-12);
+ assert!(start.abs() < 1e-12 && (sweep - PI / 2.0).abs() < 1e-12);
+ // Clockwise the other way round: about (1,1).
+ let (cx, cy, _, _, sweep) = bulge_arc([1.0, 0.0], [0.0, 1.0], -quarter).unwrap();
+ assert!((cx - 1.0).abs() < 1e-12 && (cy - 1.0).abs() < 1e-12 && sweep < 0.0);
+ // Three quarters of a turn: its middle point on the far side.
+ let pts = bulge_points([1.0, 0.0], [0.0, -1.0], (3.0 * PI / 8.0).tan(), 2);
+ assert!(
+ dist(pts[1], [-(0.5f64.sqrt()), 0.5f64.sqrt()]) < 1e-12,
+ "{pts:?}"
+ );
+ assert!(bulge_arc([1.0, 0.0], [0.0, 1.0], 0.0).is_none());
+ }
+
/// `f`'s result, or a failure if it has not returned within five seconds
/// (the thread is left spinning; the test binary exits anyway).
fn finishes(f: impl FnOnce() -> T + Send + 'static) -> T {
diff --git a/crates/exav-render/src/formats/dwg/dimension.rs b/crates/exav-render/src/formats/dwg/dimension.rs
new file mode 100644
index 0000000..6801a41
--- /dev/null
+++ b/crates/exav-render/src/formats/dwg/dimension.rs
@@ -0,0 +1,471 @@
+//! A dimension's graphics, for one saved without the anonymous block AutoCAD
+//! draws it from: generators often leave the block out. The geometry follows
+//! the definition points and the style's sizes; what this leaves to the
+//! block (DIMTIH, DIMLUNIT's feet and inches, tolerances, alternate units,
+//! arrows flipped outside a short dimension) is not drawn.
+
+use crate::cad::{DimStyle, Dimension, DimensionKind, Vec3};
+
+/// A style's sizes in drawing units (DIMSCALE applied) and how it writes
+/// numbers.
+pub struct Style {
+ pub asz: f64,
+ pub exo: f64,
+ pub exe: f64,
+ pub dle: f64,
+ pub tsz: f64,
+ pub txt: f64,
+ pub gap: f64,
+ /// Text above the dimension line, else centred on it, the line broken.
+ pub above: bool,
+ pub zin: i16,
+ pub lfac: f64,
+ pub dec: usize,
+ pub adec: usize,
+ pub dsep: char,
+}
+
+impl Style {
+ pub fn new(s: &DimStyle) -> Style {
+ let scale = if s.dimscale > 0.0 && s.dimscale.is_finite() {
+ s.dimscale
+ } else {
+ 1.0
+ };
+ let size = |v: f64| if v.is_finite() { v.abs() * scale } else { 0.0 };
+ let places = |v: i16| usize::from(v.clamp(0, 8) as u8);
+ Style {
+ asz: size(s.dimasz),
+ exo: size(s.dimexo),
+ exe: size(s.dimexe),
+ dle: size(s.dimdle),
+ tsz: size(s.dimtsz),
+ txt: size(s.dimtxt),
+ gap: size(s.dimgap),
+ above: s.dimtad != 0,
+ zin: s.dimzin,
+ lfac: if s.dimlfac.is_finite() && s.dimlfac != 0.0 {
+ s.dimlfac.abs()
+ } else {
+ 1.0
+ },
+ dec: places(s.dimdec),
+ adec: places(s.dimadec),
+ dsep: char::from_u32(u32::from(s.dimdsep.max(0) as u16))
+ .filter(|c| !c.is_control())
+ .unwrap_or('.'),
+ }
+ }
+}
+
+/// The text, its middle at `at`, turned by `rotation` (radians).
+pub struct Label {
+ pub text: String,
+ pub at: [f64; 2],
+ pub rotation: f64,
+}
+
+#[derive(Default)]
+pub struct Graphics {
+ pub lines: Vec<[[f64; 2]; 2]>,
+ /// Centre, radius, start angle and signed sweep (radians).
+ pub arcs: Vec<([f64; 2], f64, f64, f64)>,
+ /// An arrowhead's tip, and a point it points away from.
+ pub arrows: Vec<([f64; 2], [f64; 2])>,
+ pub label: Option