#######################################################################################################################################
# Default extraction rules, loaded when --extract is specified.
#
# <lower-case unique string from binwalk output text>:<desired file extension>:<command to execute>:<successful command return codes>:<False to not scan extracted files/directories>
#
# Note that %e is a place holder for the extracted file name.
#
# The %% place holder is used when a unique file path is required.
# For example '%%squashfs-root%%' will be replaced with 'squashfs-root-0'
# if 'squashfs-root' already exists.
#
# The following file types are handled internally by extractor plugins:
#
#   o zlib
#   o cpio
#   o Raw LZMA/deflate streams
#
# There are also alternative extractors for the following file formats, implemented as plugins:
#
#   o gzip
#   o lzma
#   o xz
#
#######################################################################################################################################

# Assumes these utilities are installed in $PATH.
^gzip compressed data:gz:gzip -d -f '%e':0,2
^lzma compressed data:7z:7z e -y '%e':0,1
^xz compressed data:xz:7z e -y '%e':0,1
^bzip2 compressed data:bz2:bzip2 -d '%e'
^compress'd data:Z:gzip -d '%e'
^zip archive data:zip:7z x -y '%e' -p '':0,1
^posix tar archive:tar:tar xvf '%e'
^rar archive data:rar:unrar e '%e'
^rar archive data:rar:unrar -x '%e' # This is for the 'free' version
^arj archive data.*comment header:arj:arj -y e '%e'
^lha:lha:lha ei '%e'
^iso 9660:iso:7z x '%e' -oiso-root
^microsoft cabinet archive:cab:cabextract '%e'
^stuffit:sit:unstuff '%e'

# Try unsquashfs first, or if not installed, sasquatch
^squashfs filesystem:squashfs:unsquashfs -d '%%squashfs-root%%' '%e':0:False
^squashfs filesystem:squashfs:sasquatch -p 1 -le -d '%%squashfs-root%%' '%e':0:False
^squashfs filesystem:squashfs:sasquatch -p 1 -be -d '%%squashfs-root%%' '%e':0:False

# Try cramfsck first; if that fails, swap the file system and try again
^cramfs filesystem:cramfs:cramfsck -x '%%cramfs-root%%' '%e':0:False
^cramfs filesystem:cramfs:cramfsswap '%e' '%e.swap' && cramfsck -x '%%cramfs-root%%' '%e.swap':0:False

# Extract EXT filesystems using sleuth kit
^linux ext:ext:tsk_recover -i raw -f ext -a -v '%e' '%%ext-root%%':0:False

# Try mounting the file system (this requires root privileges)
^squashfs filesystem:squashfs:mkdir squashfs-root && mount -t squashfs '%e' squashfs-root:0:False
^cramfs filesystem:cramfs:mkdir cramfs-root && mount -t cramfs '%e' cramfs-root:0:False
^ext2 filesystem:ext2:mkdir ext2-root && mount -t ext2 '%e' ext2-root:0:False
^romfs filesystem:romfs:mkdir romfs-root && mount -t romfs '%e' romfs-root:0:False

# Use sviehb's jefferson.py tool for JFFS2 extraction
^jffs2 filesystem:jffs2:jefferson -d '%%jffs2-root%%' '%e':0:False

# Use ubi_reader tool for UBIFS extraction
^ubifs filesystem superblock node:ubi:ubireader_extract_files -o '%%ubifs-root%%' '%e':0:False
^ubi erase count header:ubi:ubireader_extract_files -o '%%ubifs-root%%' '%e':0:False

# These were extractors used from FMK that still need suitable replacements.
#^bff volume entry:bff:/opt/firmware-mod-kit/src/bff/bffxtractor.py '%e'
#^wdk file system:wdk:/opt/firmware-mod-kit/src/firmware-tools/unwdk.py '%e'

# Extract, but don't run anything
^elf,:elf
private key:key
certificate:crt
html document header
xml document:xml

