C Sample Identification ETL

This sample shows the steps needed to implement a byte identifier ETL in C. You can see this same sample implemented in Python.

Sample File Format

This sample will identify a fake file format we call Acme. Acme Corporation is a known supplier of nefarious devices and explosives. Their file format begins with a five byte magic value followed by eleven bytes in a data structure.

0000h: 88 77 66 55 00 11 22 33 44 55 66 77 88 99 AA BB
0010h: CC

Visual Studio Configuration

The steps to creating a program to create a file content identification ETL are:

1. Start Visual Studio
2. File->New->Project
3. Empty Project - C++
4. Project name: IdentifyFile
5. Press "Create" button
6. Remove the x86 configuration
7. Right button on the IdentifyFileproject in the Solution Explorer window
8. Add->New Item...->C++ File->Add button
9. Right button on the IdentifyFileproject in the Solution Explorer window
10. Select Properties
11. C/C++->Additional Include Directories: add "C:\Program Files\Truxton\SDK"
12. Linker->Additional Library Directories: add "C:\Truxton" (or wherever you generated the TruxtonCAPI.lib file)

Source Code

#include <stdio.h>
#include <memory.h>
#include <inttypes.h>
#include <TruxtonCAPI.h>
#include <TruxtonFileTypes.h>
#include <TruxtonDefines.h>
#pragma comment (lib, "TruxtonCAPI.lib")

int main(void)
{
  uint8_t buffer[10];

  uint64_t message = 0;

  uint64_t etl_application = truxton_etl_create();

  truxton_etl_set_application_name(etl_application, "My Identify File");
  truxton_etl_set_description(etl_application, "Identifier ETL for new file type");
  truxton_etl_set_queue_name(etl_application, "mif");
  truxton_etl_set_stage_number(etl_application, 2);

  truxton_etl_add_desired_file_type(etl_application, Type_Unknown);

  //truxton_etl_send_me_file_id(etl_application, "6068992f-af6b-06b8-28ce-094b0000000d");

  message = truxton_etl_get_message(etl_application);

  while (message != 0)
  {
    if (truxton_message_get_depot_length(message) >= 16 &&
        truxton_message_get_signature(message) == 0x88776655)
    {
      uint64_t file_in_truxton = truxton_message_get_file(message);

      if (file_in_truxton != 0)
      {
        truxton_file_seek(file_in_truxton, 4, SEEK_SET);

        if (truxton_file_read(file_in_truxton, buffer, 1) == 1)
        {
          if (buffer[0] == 0x00)
          {
            truxton_file_change_type(file_in_truxton, 11111);
            truxton_message_set_file_type(message, 11111);
            truxton_route_message(truxton_file_get_truxton(file_in_truxton), message);
          }
        }
      }

      truxton_file_free(file_in_truxton);
    }

    truxton_message_destroy(message);

    message = truxton_etl_get_message(etl_application);
  }

  truxton_etl_destroy(etl_application);
  return(0);
}