How to match 1 of several child structures

+1 vote
asked Aug 13, 2020 by okachobi (130 points)
I have a file format that is divided into sections identified by guids.  Each section has a header and then some data.  The data can be one of several formats.  If a 16 byte guid matches one of a few structures, then I want to present the data as that structure.  If it matches none of them, I want to represent it as just bytes.

i got it partially work.  For the data element, I added a structure with a size and then used structure references under that structure to define the possible matches.  I set the top level structure to have a variable data element order, then added 2 references under it that were set from 0 to unlimited in counts. Those structures that are referenced each have 1 field at at the start that is a guid that has a must match attribute set.

I expected that the data element would match the appropriate structure, but it only matches if it matches the first child structure.  It doesn't appear to be matching the second despite the binary data showing that it matches the second.

What am I missing?

1 Answer

0 votes
answered Feb 17, 2023 by guruadmin (680 points)

Could you please send the grammar with a sample file to grammars@synalysis.com? It's hard to solve such issues without having the actual grammar.

...