.NET support for Kaitai Struct

Year: 2016 URL: http://kaitai.io

Kaitai Struct is a file deconstruction tool and Domain Specific Language. The goal is to make reverse engineering file formats easier by describing the format of the filetype in a human-readable interface. The language is just YAML, but structured in a clever way.

For instance, the Quake PAK format can be described as


meta:
  id: quake_pak
  file-extension: pak
  application: Quake game engine
  license: CC0-1.0
  endian: le
doc-ref: 'https://quakewiki.org/wiki/.pak#Format_specification'
seq:
  - id: magic
    contents: 'PACK'
  - id: ofs_index
    type: u4
  - id: len_index
    type: u4
instances:
  index:
    pos: ofs_index
    size: len_index
    type: index_struct
types:
  index_struct:
    seq:
      - id: entries
        type: index_entry
        repeat: eos
  index_entry:
    seq:
      - id: name
        type: str
        size: 56
        encoding: UTF-8
        terminator: 0
        pad-right: 0
      - id: ofs
        type: u4
      - id: size
        type: u4
    instances:
      body:
        pos: ofs
        size: size
        io: _root._io

This can then be compiled into source for multiple different target platforms, such as Python, Java, Ruby, or C#.

I implemented a C# version of the underlying byte-consumer engine which was able to handle most cases. This was quickly reimplemented using a different approach, but much of my original work was getting the project’s .NET support stood up.