//------------------------------------------------
//--- 010 Editor Binary Template
// File:     FLIRT_SIG_full_010Editor.bt
// Version:  1.1 (adaptive color styles)
// Purpose:  Parse IDA FLIRT IDASGN signature files (v5-v10)
// Notes:    Parses uncompressed Trie bodies. If FEATURE_COMPRESSED is set,
//           the compressed body is mapped as raw zlib payload and must be
//           decompressed externally before the Trie can be expanded.
// Colors:   Uses adaptive Template Styles (010 Editor v14+).
// File Mask: *.sig
// ID Bytes:  49 44 41 53 47 4E
//------------------------------------------------

LittleEndian();

// -----------------------------------------------------------------------------
// Adaptive color legend (010 Editor v14+)
// -----------------------------------------------------------------------------
// sHeading1 : FLIRT file header
// sSection1 : Trie nodes and pattern bytes
// sSection2 : Leaf module groups and CRC data
// sSection3 : Public function records and names
// sSection4 : Referenced function records and names
// sMarker   : Tail-byte constraints
// sData     : Generic variable-length integer payloads
// Accent variants highlight key bytes inside each category.
// Styles automatically adapt to light/dark themes and can be customized under
// Theme/Color Options -> Template Styles.

// -----------------------------------------------------------------------------
// Constants
// -----------------------------------------------------------------------------
#define FEATURE_STARTUP             0x0001
#define FEATURE_CTYPE_CRC           0x0002
#define FEATURE_2BYTE_CTYPE         0x0004
#define FEATURE_ALT_CTYPE_CRC       0x0008
#define FEATURE_COMPRESSED          0x0010

#define PF_MORE_PUBLIC_NAMES        0x01
#define PF_READ_TAIL_BYTES          0x02
#define PF_READ_REFERENCED_FUNCS    0x04
#define PF_MORE_MODULES_SAME_CRC    0x08
#define PF_MORE_MODULES             0x10

#define FF_LOCAL                    0x02
#define FF_UNRESOLVED_COLLISION     0x08

#define MAX_NODE_LEN                0x40
#define MAX_SCAN_NAME               4096
#define MAX_REASONABLE_COUNT        1000000

// -----------------------------------------------------------------------------
// Global statistics
// -----------------------------------------------------------------------------
local uint32 g_nodes       = 0;
local uint32 g_leaves      = 0;
local uint32 g_modules     = 0;
local uint32 g_publics     = 0;
local uint32 g_tails       = 0;
local uint32 g_refs        = 0;
local uint32 g_max_depth   = 0;
local int    g_verbose     = 1; // 0=summary, 1=node/module summary, 2=verbose

// -----------------------------------------------------------------------------
// Utility functions
// -----------------------------------------------------------------------------
string Indent(int depth) {
    local string s;
    local int i;
    s = "";
    if (depth > 48) depth = 48;
    for (i = 0; i < depth; i++) s += "  ";
    return s;
}

uint64 PopCount64(uint64 v) {
    local uint64 n;
    n = 0;
    while (v != 0) {
        n += (v & 1);
        v >>= 1;
    }
    return n;
}

string BytesToText(int64 pos, uint64 len, int strip_final_nul) {
    local string out;
    local string tmp;
    local uint64 i;
    local ubyte b;
    out = "";
    if (strip_final_nul && len > 0 && ReadUByte(pos + len - 1) == 0)
        len--;
    for (i = 0; i < len; i++) {
        b = ReadUByte(pos + i);
        if (b >= 0x20 && b <= 0x7E) {
            SPrintf(tmp, "%c", b);
        } else {
            SPrintf(tmp, "\\x%02X", b);
        }
        out += tmp;
    }
    return out;
}

int ScanUntilControl(int64 pos) {
    local int n;
    local ubyte b;
    n = 0;
    while ((pos + n) < FileSize() && n < MAX_SCAN_NAME) {
        b = ReadUByte(pos + n);
        if (b < 0x20) break;
        n++;
    }
    if (n == MAX_SCAN_NAME)
        Warning("FLIRT name scan reached MAX_SCAN_NAME; file may be malformed.");
    return n;
}

string PatternText(int node_len, uint64 variant_mask, int64 concrete_pos) {
    local string out;
    local string tmp;
    local int i;
    local int j;
    local uint64 bit;
    out = "";
    j = 0;
    for (i = 0; i < node_len; i++) {
        bit = ((uint64)1 << (node_len - 1 - i));
        if ((variant_mask & bit) != 0) {
            out += "..";
        } else {
            SPrintf(tmp, "%02X", ReadUByte(concrete_pos + j));
            out += tmp;
            j++;
        }
        if (i + 1 < node_len) out += " ";
    }
    return out;
}

// -----------------------------------------------------------------------------
// FLIRT variable-length integer encodings
// -----------------------------------------------------------------------------
// read_multiple_bytes():
//   0xxxxxxx                                  -> 1 byte
//   10xxxxxx xxxxxxxx                         -> 2 bytes
//   110xxxxx xxxxxxxx xxxxxxxx xxxxxxxx       -> 4 bytes
//   111xxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx -> 5 bytes
// The 4-byte form contributes only six bits from b0, matching public parsers.
// -----------------------------------------------------------------------------
typedef struct {
    ubyte b0 <format=hex, style=sDataAccent>;
    if ((b0 & 0x80) == 0) {
        // one-byte encoding
    } else if ((b0 & 0xC0) != 0xC0) {
        ubyte b1_2 <format=hex, style=sData>;
    } else if ((b0 & 0xE0) != 0xE0) {
        ubyte b1_4 <format=hex, style=sData>;
        ubyte b2_4 <format=hex, style=sData>;
        ubyte b3_4 <format=hex, style=sData>;
    } else {
        ubyte b1_5 <format=hex, style=sData>;
        ubyte b2_5 <format=hex, style=sData>;
        ubyte b3_5 <format=hex, style=sData>;
        ubyte b4_5 <format=hex, style=sData>;
    }
} VLI_MULTI <read=FmtVLIMulti, style=sData>;

uint64 GetVLIMulti(VLI_MULTI &v) {
    if ((v.b0 & 0x80) == 0)
        return v.b0;
    if ((v.b0 & 0xC0) != 0xC0)
        return (((uint64)(v.b0 & 0x7F)) << 8) | v.b1_2;
    if ((v.b0 & 0xE0) != 0xE0)
        return (((uint64)(v.b0 & 0x3F)) << 24) |
               (((uint64)v.b1_4) << 16) |
               (((uint64)v.b2_4) << 8)  |
               ((uint64)v.b3_4);
    return (((uint64)v.b1_5) << 24) |
           (((uint64)v.b2_5) << 16) |
           (((uint64)v.b3_5) << 8)  |
           ((uint64)v.b4_5);
}

string FmtVLIMulti(VLI_MULTI &v) {
    local string s;
    SPrintf(s, "%Lu (0x%LX)", GetVLIMulti(v), GetVLIMulti(v));
    return s;
}

// Legacy compact integer used by v5-v8 offsets.
typedef struct {
    ubyte b0 <format=hex, style=sDataAccent>;
    if ((b0 & 0x80) != 0)
        ubyte b1 <format=hex, style=sData>;
} VLI_MAX2 <read=FmtVLIMax2, style=sData>;

uint64 GetVLIMax2(VLI_MAX2 &v) {
    if ((v.b0 & 0x80) == 0)
        return v.b0;
    return (((uint64)(v.b0 & 0x7F)) << 8) | v.b1;
}

string FmtVLIMax2(VLI_MAX2 &v) {
    local string s;
    SPrintf(s, "%Lu (0x%LX)", GetVLIMax2(v), GetVLIMax2(v));
    return s;
}

// v9-v10 use read_multiple_bytes() for offsets and lengths; older versions
// use the compact one/two-byte encoding.
struct ENCODED_VALUE (int version) {
    if (version >= 9)
        VLI_MULTI multi <style=sData>;
    else
        VLI_MAX2 legacy <style=sData>;
};

uint64 GetEncodedValue(ENCODED_VALUE &v, int version) {
    if (version >= 9)
        return GetVLIMulti(v.multi);
    return GetVLIMax2(v.legacy);
}

// -----------------------------------------------------------------------------
// Header
// -----------------------------------------------------------------------------
typedef struct {
    char   magic[6] <style=sHeading1Accent>;
    ubyte  version <style=sHeading1Accent>;
    ubyte  arch <style=sHeading1Accent>;
    uint32 file_types <format=hex, style=sHeading1>;
    uint16 os_types <format=hex, style=sHeading1>;
    uint16 app_types <format=hex, style=sHeading1>;
    uint16 features <format=hex, style=sHeading1Accent>;
    uint16 old_n_functions <style=sHeading1>;
    uint16 header_crc16 <format=hex, style=sHeading1Accent>;
    ubyte  ctype[12] <format=hex, style=sHeading1>;
    ubyte  library_name_len <style=sHeading1Accent>;
    uint16 ctypes_crc16 <format=hex, style=sHeading1Accent>;
    if (version >= 6)
        uint32 n_functions <style=sHeading1>;
    if (version >= 8)
        uint16 pattern_size <style=sHeading1>;
    if (version > 9)
        uint16 unknown_v10 <format=hex, style=sHeading1>;
} FLIRT_HEADER <read=FmtHeader, style=sHeading1>;

string ArchName(ubyte arch) {
    local string s;
    switch (arch) {
        case 0:  return "x86";
        case 12: return "MIPS";
        case 13: return "ARM";
        case 15: return "PowerPC";
        case 19: return ".NET";
        case 23: return "SPARC";
        case 31: return "IA64";
        case 60: return "Dalvik";
        default:
            SPrintf(s, "arch_%u", arch);
            return s;
    }
}

uint32 HeaderFunctionCount(FLIRT_HEADER &h) {
    if (h.version >= 6) return h.n_functions;
    return h.old_n_functions;
}

string FmtHeader(FLIRT_HEADER &h) {
    local string s;
    SPrintf(s, "IDASGN v%u arch=%s funcs=%u features=0x%04X",
            h.version, ArchName(h.arch), HeaderFunctionCount(h), h.features);
    return s;
}

// -----------------------------------------------------------------------------
// Leaf records: public names, tail bytes and referenced functions
// -----------------------------------------------------------------------------
struct PUBLIC_FUNCTION (int version) {
    ENCODED_VALUE offset_delta(version) <style=sSection3Accent>;

    local ubyte probe;
    local int64 name_pos;
    local int name_len;
    local ubyte meta_value;

    probe = ReadUByte(FTell());
    meta_value = 0;
    if (probe < 0x20) {
        ubyte function_flags <format=hex, style=sSection3Accent,
            comment="Optional metadata: bit1=local/static, bit3=unresolved collision">;
        meta_value = function_flags;
    }

    name_pos = FTell();
    name_len = ScanUntilControl(name_pos);
    if (name_len > 0)
        char name[name_len] <style=sSection3Accent>;

    // The first control byte after the name is not a NUL terminator in the
    // general case. It is the module parsing flag byte.
    ubyte parse_flags <format=hex, style=sSection3Accent,
        comment="bit0=more public names, bit1=tail bytes, bit2=refs, bit3=more same CRC, bit4=more CRC groups">;
};

string PublicName(PUBLIC_FUNCTION &f) {
    return BytesToText(f.name_pos, f.name_len, 0);
}

struct TAIL_BYTE (int version) {
    ENCODED_VALUE relative_offset(version) <style=sMarker>;
    ubyte value <format=hex, style=sMarkerAccent>;
};

struct TAIL_LIST (int version) {
    local uint32 i;
    local uint32 count;
    count = 1;
    if (version >= 8) {
        ubyte count_u8 <style=sMarkerAccent>;
        count = count_u8;
    }
    for (i = 0; i < count; i++) {
        TAIL_BYTE tail(version) <style=sMarker>;
        g_tails++;
    }
};

struct REFERENCED_FUNCTION (int version) {
    ENCODED_VALUE relative_offset(version) <style=sSection4>;
    ubyte short_name_len <style=sSection4Accent>;

    local uint64 full_name_len;
    local int64 name_pos;
    local int negative_offset;

    full_name_len = short_name_len;
    if (short_name_len == 0) {
        VLI_MULTI extended_name_len <style=sSection4Accent>;
        full_name_len = GetVLIMulti(extended_name_len);
    }

    if (full_name_len > MAX_SCAN_NAME)
        Warning("Referenced function name is unusually long; file may be malformed.");

    name_pos = FTell();
    if (full_name_len > 0)
        ubyte raw_name[full_name_len] <style=sSection4Accent>;

    negative_offset = (full_name_len > 0 && ReadUByte(name_pos + full_name_len - 1) == 0);
};

string ReferencedName(REFERENCED_FUNCTION &f) {
    return BytesToText(f.name_pos, f.full_name_len, f.negative_offset);
}

struct REFERENCED_LIST (int version) {
    local uint32 i;
    local uint32 count;
    count = 1;
    if (version >= 8) {
        ubyte count_u8 <style=sSection4Accent>;
        count = count_u8;
    }
    for (i = 0; i < count; i++) {
        REFERENCED_FUNCTION ref(version) <style=sSection4>;
        g_refs++;
        if (g_verbose >= 2) {
            Printf("      [REF] off=0x%LX name=%s%s\n",
                   GetEncodedValue(ref.relative_offset, version),
                   ReferencedName(ref),
                   ref.negative_offset ? " (negative offset)" : "");
        }
    }
};

struct MODULE (int version, ubyte crc_length, uint16 crc16_value, int depth) {
    local string ind;
    local int more_public;
    local uint64 running_offset;
    local ubyte terminal_flags;

    ind = Indent(depth);
    ENCODED_VALUE module_length(version) <style=sSection2Accent>;

    g_modules++;
    if (g_verbose >= 1) {
        Printf("%s[MODULE #%u] crc_len=%u crc16=0x%04X module_len=0x%LX\n",
               ind, g_modules, crc_length, crc16_value,
               GetEncodedValue(module_length, version));
    }

    running_offset = 0;
    terminal_flags = 0;
    more_public = 1;
    while (more_public && !FEof()) {
        PUBLIC_FUNCTION public_fn(version) <style=sSection3>;
        running_offset += GetEncodedValue(public_fn.offset_delta, version);
        terminal_flags = public_fn.parse_flags;
        g_publics++;

        if (g_verbose >= 1) {
            Printf("%s  [PUBLIC #%u] +0x%LX flags=0x%02X meta=0x%02X name=%s\n",
                   ind, g_publics, running_offset,
                   public_fn.parse_flags, public_fn.meta_value,
                   PublicName(public_fn));
        }

        more_public = ((terminal_flags & PF_MORE_PUBLIC_NAMES) != 0);
    }

    if ((terminal_flags & PF_READ_TAIL_BYTES) != 0)
        TAIL_LIST tails(version) <style=sMarker>;
    if ((terminal_flags & PF_READ_REFERENCED_FUNCS) != 0)
        REFERENCED_LIST refs(version) <style=sSection4>;

    local ubyte final_parse_flags;
    final_parse_flags = terminal_flags;
};

struct MODULE_GROUP (int version, int depth) {
    local string ind;
    local uint16 crc16_value;
    local int more_same_crc;
    local ubyte last_flags;

    ind = Indent(depth);
    ubyte crc_length <style=sSection2Accent>;
    ubyte crc16_hi <format=hex, style=sSection2>;
    ubyte crc16_lo <format=hex, style=sSection2>;
    crc16_value = (((uint16)crc16_hi) << 8) | crc16_lo;

    more_same_crc = 1;
    last_flags = 0;
    while (more_same_crc && !FEof()) {
        MODULE module(version, crc_length, crc16_value, depth) <style=sSection2>;
        last_flags = module.final_parse_flags;
        more_same_crc = ((last_flags & PF_MORE_MODULES_SAME_CRC) != 0);
    }

    local int more_crc_groups;
    more_crc_groups = ((last_flags & PF_MORE_MODULES) != 0);
};

struct MODULE_LIST (int version, int depth) {
    local int more_groups;
    more_groups = 1;
    while (more_groups && !FEof()) {
        MODULE_GROUP group(version, depth) <style=sSection2>;
        more_groups = group.more_crc_groups;
    }
};

// -----------------------------------------------------------------------------
// Trie nodes
// -----------------------------------------------------------------------------
struct FLIRT_NODE;

struct FLIRT_NODE (int version, int is_root, int depth, uint32 prefix_len) {
    local string ind;
    local uint64 variant_mask;
    local uint64 fixed_count;
    local int64 concrete_pos;
    local uint64 child_count_value;
    local uint32 i;

    ind = Indent(depth);
    if ((uint32)depth > g_max_depth) g_max_depth = depth;
    g_nodes++;

    variant_mask = 0;
    fixed_count = 0;
    concrete_pos = FTell();

    if (!is_root) {
        ubyte node_length <style=sSection1Accent>;
        if (node_length > MAX_NODE_LEN)
            Warning("FLIRT node length is greater than 64; parser will continue conservatively.");

        if (node_length < 0x10) {
            VLI_MAX2 variant_mask_short <style=sSection1>;
            variant_mask = GetVLIMax2(variant_mask_short);
        } else if (node_length <= 0x20) {
            VLI_MULTI variant_mask_low <style=sSection1>;
            variant_mask = GetVLIMulti(variant_mask_low);
        } else if (node_length <= 0x40) {
            VLI_MULTI variant_mask_high <style=sSection1>;
            VLI_MULTI variant_mask_low <style=sSection1>;
            variant_mask = (GetVLIMulti(variant_mask_high) << 32) |
                           GetVLIMulti(variant_mask_low);
        }

        fixed_count = node_length - PopCount64(variant_mask);
        concrete_pos = FTell();
        if (fixed_count > 0)
            ubyte concrete_bytes[fixed_count] <format=hex, style=sSection1Accent>;

        if (g_verbose >= 1) {
            Printf("%s[NODE #%u] depth=%u segment=%u prefix=%u mask=0x%LX fixed=%Lu pattern=%s\n",
                   ind, g_nodes, depth, node_length, prefix_len + node_length,
                   variant_mask, fixed_count,
                   PatternText(node_length, variant_mask, concrete_pos));
        }

        prefix_len += node_length;
    } else if (g_verbose >= 1) {
        Printf("[ROOT NODE]\n");
    }

    VLI_MULTI child_count <style=sSection1Accent>;
    child_count_value = GetVLIMulti(child_count);

    if (child_count_value > MAX_REASONABLE_COUNT)
        Warning("Unreasonable FLIRT child count; file may be malformed.");

    if (child_count_value == 0) {
        g_leaves++;
        if (g_verbose >= 1)
            Printf("%s[LEAF #%u] prefix=%u\n", ind, g_leaves, prefix_len);
        MODULE_LIST modules(version, depth + 1) <style=sSection2>;
    } else {
        for (i = 0; i < child_count_value; i++)
            FLIRT_NODE child(version, 0, depth + 1, prefix_len) <style=sSection1>;
    }
};

// -----------------------------------------------------------------------------
// Main
// -----------------------------------------------------------------------------
Printf("============================================================\n");
Printf("IDA FLIRT IDASGN parser for 010 Editor\n");
Printf("============================================================\n");

FLIRT_HEADER hdr <style=sHeading1>;

if (Strncmp(hdr.magic, "IDASGN", 6) != 0) {
    Warning("Not an IDASGN FLIRT signature file.");
} else if (hdr.version < 5 || hdr.version > 10) {
    Warning("Unsupported FLIRT signature version. Expected v5-v10.");
} else {
    char library_name[hdr.library_name_len] <style=sHeading1Accent>;

    Printf("[HEADER] version       : %u\n", hdr.version);
    Printf("[HEADER] architecture  : %s (%u)\n", ArchName(hdr.arch), hdr.arch);
    Printf("[HEADER] file types    : 0x%08X\n", hdr.file_types);
    Printf("[HEADER] os types      : 0x%04X\n", hdr.os_types);
    Printf("[HEADER] app types     : 0x%04X\n", hdr.app_types);
    Printf("[HEADER] features      : 0x%04X\n", hdr.features);
    Printf("[HEADER] functions     : %u\n", HeaderFunctionCount(hdr));
    if (hdr.version >= 8)
        Printf("[HEADER] pattern size  : %u\n", hdr.pattern_size);
    Printf("[HEADER] library name  : %s\n", BytesToText(startof(library_name), hdr.library_name_len, 0));
    Printf("[BODY]   starts at     : 0x%LX\n", FTell());

    if ((hdr.features & FEATURE_COMPRESSED) != 0) {
        ubyte compressed_zlib_payload[FileSize() - FTell()] <format=hex, style=sMarkerAccent,
            comment="Compressed zlib Trie body. Decompress externally before expanding Trie records.">;
        Warning("FEATURE_COMPRESSED is set. Header is parsed, but the Trie body remains zlib-compressed.");
    } else {
        FLIRT_NODE root(hdr.version, 1, 0, 0) <style=sSection1>;

        Printf("============================================================\n");
        Printf("[SUMMARY] nodes        : %u\n", g_nodes);
        Printf("[SUMMARY] leaves       : %u\n", g_leaves);
        Printf("[SUMMARY] modules      : %u\n", g_modules);
        Printf("[SUMMARY] public names : %u\n", g_publics);
        Printf("[SUMMARY] tail bytes   : %u\n", g_tails);
        Printf("[SUMMARY] references   : %u\n", g_refs);
        Printf("[SUMMARY] max depth    : %u\n", g_max_depth);
        Printf("[SUMMARY] final offset : 0x%LX / 0x%LX\n", FTell(), FileSize());
        if (FTell() != FileSize())
            Warning("The template did not consume the full file. Check version, compression flag or malformed data.");
    }
}