2b:null 2c:["$","title",null,{"children":"Parsing QResource Binary Blobs | Michael Pishchagin | Observable"}] 31:T581,# Parsing QResource Binary Blobs * [Binary Ninja plugin for QResource extraction](https://github.com/mblsha/binja-qresource/tree/master) This is an interactive demonstration how to parse binary blobs generated by the [Qt Resource Compiler (rcc)](https://doc.qt.io/qt-6/resources.html), which are registered within binaries using [qRegisterResourceData](https://wiki.qt.io/QtResources) function. Typically, binary blobs created by rcc comprise three main sections: * The `tree` structure outlines the files and directories. Files are tagged with a last_modified timestamp. * The `names` section, referenced by the tree nodes, contains binary checksums. * The `payload` section includes the size and data of the file. ## Example: Consider a sample file generated by `rcc` from the XML definition below: ```xml res/1.txt res/bardir/4.txt res/bardir/5.txt res/6.txt res/foodir/2.txt res/foodir/3.txt ``` This file is integrated into the binary using the method shown: ```cpp char* blob = ...; const int names_start_offset = 0xdc; const int payload_start_offset = 0x16c; qRegisterResourceData(3, blob, blob + names_start_offset, blob + payload_start_offset); ``` To begin parsing the blob, first load the binary data from the attached file:32:T5a4,ksy_tree = ` meta: id: qresource_tree file-extension: qrcbin license: MIT endian: be # https://github.com/qt/qtbase/blob/dev/src/corelib/io/qresource.cpp seq: - id: root type: tree(3) types: tree: params: - id: version type: u1 instances: node_size: value: version >= 2 ? 22 : 14 compressed: value: (flags & 0x01) != 0 directory: value: (flags & 0x02) != 0 compressed_zstd: value: (flags & 0x04) != 0 children: io: _root._io pos: first_child_index * node_size type: tree(version) repeat: expr repeat-expr: children_count if: directory seq: - id: name_offset type: u4 # 4 - id: flags type: u2 # 6 # directory - id: children_count type: u4 # 10 if: directory - id: first_child_index type: u4 # 14 if: directory # file - id: locale type: locale_info # 10 if: not directory - id: data_offset type: u4 # 14 if: not directory # must be at offset 14 - id: last_modified type: u8 # 22 if: version >= 2 -webide-representation: '{data_offset} offs:{name_offset}' locale_info: seq: - id: territory type: u2 - id: language type: u2 -webide-representation: '{territory:dec}_{language:dec}' `33:[{"id":"83a69956fb41444287fcc849f1415803333756d1dd540b3f7bebbaef7ad81285bd6b544d429a9ab572e3e985436f4bf89d92758c49acbc552f3955ddee8291f0","href":"https://static.observableusercontent.com/files/83a69956fb41444287fcc849f1415803333756d1dd540b3f7bebbaef7ad81285bd6b544d429a9ab572e3e985436f4bf89d92758c49acbc552f3955ddee8291f0","name":"test2.qrcbin","type":"application/octet-stream","lastModified":1708920084298.701,"size":400}] 2f:{"id":"a7ae255e6f791125","slug":"qresource-blob-parser","title":"Parsing QResource Binary Blobs","thumbnail":"878c777569d5c99890a7388bba603c9e6faf56e7be64c2a3941ff115e3dfbf53","access_level":"public","create_time":"$D2024-02-26T03:19:23.314Z","update_time":"$D2024-02-27T05:48:49.729Z","view_time":null,"first_public_time":"$D2024-02-26T04:50:20.731Z","fork":true,"stars":0,"starred":false,"owner":{"type":"team","id":"1b0be4f887c3e432","login":"mblsha","name":"Michael Pishchagin","avatar_url":"https://avatars-next.observableusercontent.com/07aa99e148938f2d246b833f8a8a78f5a0b7e21f1170f4b685321bdf95972755","tier":"starter_2024"},"version":297,"publish_version":null,"role":null,"authored":false,"authors":[{"type":"individual","id":"7263300410edddff","login":"mblsha","name":"Michael Pishchagin","avatar_url":"https://avatars-next.observableusercontent.com/07aa99e148938f2d246b833f8a8a78f5a0b7e21f1170f4b685321bdf95972755","tier":null}],"members":[{"type":"team","id":"1b0be4f887c3e432","login":"mblsha","name":"Michael Pishchagin","avatar_url":"https://avatars-next.observableusercontent.com/07aa99e148938f2d246b833f8a8a78f5a0b7e21f1170f4b685321bdf95972755","tier":"starter_2024","role":"editor"},{"type":"individual","id":"7263300410edddff","login":"mblsha","name":"Michael Pishchagin","avatar_url":"https://avatars-next.observableusercontent.com/07aa99e148938f2d246b833f8a8a78f5a0b7e21f1170f4b685321bdf95972755","tier":null,"role":"editor"}],"comments":[],"custom_thumbnail":false,"trashed":false,"subscribed":null,"forks":0,"collection":{"id":"5cf7011f900bd3b2","slug":"kaitai-struct","title":"Kaitai Struct","owner":{"id":"1b0be4f887c3e432","login":"mblsha","name":"Michael Pishchagin"}},"type":"notebook","body":{"title":"Parsing QResource Binary Blobs","cells":[{"id":0,"value":"$31","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined"},{"id":10,"value":"data = (await FileAttachment(\"test2.qrcbin\")).arrayBuffer()","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":268,"value":"Then we parse the `tree` structure located at the start of the binary blob using [Kaitai Struct](https://kaitai.io/):","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined"},{"id":264,"value":"root_entries = parse_tree(data).root.children","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":272,"value":"Then we walk the tree, and with the knowledge of `names`+`payloads` offsets we can list all the files together with their metadata:","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined"},{"id":73,"value":"parsed_files = get_files(\n { names_start_offset: 0xdc, payload_start_offset: 0x16c },\n root_entries\n)","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":258,"value":"# Implementation","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined"},{"id":126,"value":"function get_name(offset) {\n return parse_name(data.slice(offset)).nodeName.name;\n}","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":71,"value":"function get_files(\n { names_start_offset, payload_start_offset },\n entries,\n path = \":/\"\n) {\n let r = [];\n for (const e of entries) {\n const p =\n path +\n get_name(names_start_offset + e.nameOffset) +\n (e.directory ? \"/\" : \"\");\n\n if (e.directory) {\n r = r.concat(\n get_files({ names_start_offset, payload_start_offset }, e.children, p)\n );\n } else {\n const last_modified = new Date(e.lastModified);\n\n const view = new DataView(data);\n const data_start = payload_start_offset + e.dataOffset;\n const size = view.getInt32(data_start, false); // false for big-endian\n const arr = data.slice(data_start + 4, data_start + 4 + size);\n\n r.push({\n name: p,\n last_modified,\n data: new Uint8Array(arr)\n });\n }\n }\n return r;\n}","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":6,"value":"$32","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":5,"value":"import { parse as parse_tree } with { ksy_tree as ksy } from \"@mblsha/kaitai-parser\"","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":111,"value":"ksy_name = `\nmeta:\n id: qresource_name\n file-extension: qrcbin\n license: MIT\n endian: be\n# https://github.com/qt/qtbase/blob/dev/src/corelib/io/qresource.cpp\n\nseq:\n - id: node_name\n type: name_entry\n\ntypes:\n name_entry:\n seq:\n - id: len\n type: u2\n - id: hash\n type: u4\n - id: name\n type: str\n size: len * 2\n encoding: UTF-16BE\n -webide-representation: '\"{name}\" {hash}'\n`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"},{"id":114,"value":"import { parse as parse_name } with { ksy_name as ksy } from \"@mblsha/kaitai-parser\"","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"}],"files":"$W33","stdlib":"1","titling":"auto"}} 30:"$2f:body"