📄 unix.c
字号:
if (types[i] != 0 || i == 2) { offset = (U64)starts[i] * 512; if (!min_offset_valid || offset < min_offset) { min_offset = offset; min_offset_valid = 1; } } } /* if min_offset_valid is still 0, the default of min_offset=0 is okay */ if (section->pos == min_offset) { /* either min_offset is zero, or we were analyzing the whole disk */ base_offset = section->pos; } else if (section->pos == 0) { /* are we analyzing the slice alone? */ print_line(level + 1, "Adjusting offsets for disklabel in a DOS partition at sector %llu", min_offset >> 9); base_offset = min_offset; } else if (min_offset == 0) { /* assume relative offsets after all */ base_offset = 0; } else { print_line(level + 1, "Warning: Unable to adjust offsets, your mileage may vary"); base_offset = section->pos; } /* loop over partitions: print and analyze */ did_recurse = 0; for (i = 0; i < partcount; i++) { pn = 'a' + i; if (types[i] == 0 && i != 2) continue; sprintf(append, " from %lu", starts[i]); format_blocky_size(s, sizes[i], 512, "sectors", append); print_line(level, "Partition %c: %s", pn, s); print_line(level + 1, "Type %d (%s)", types[i], get_name_for_bsdtype(types[i])); if (types[i] == 0 || sizes[i] == 0) continue; offset = (U64)starts[i] * 512; if (offset < base_offset) { print_line(level + 1, "(Illegal start offset, no detection)"); } else if (offset == base_offset) { print_line(level + 1, "Includes the disklabel and boot code"); /* recurse for content detection, but carefully */ analyze_recursive(section, level + 1, offset - base_offset, (U64)sizes[i] * 512, FLAG_IN_DISKLABEL); did_recurse = 1; } else { /* recurse for content detection */ analyze_recursive(section, level + 1, offset - base_offset, (U64)sizes[i] * 512, 0); } } if (did_recurse) stop_detect(); /* don't run other detectors; we already did that for an overlapping partition. */}/* * FreeBSD boot loader (?) */void detect_bsd_loader(SECTION *section, int level) { unsigned char *buf; if (section->flags & FLAG_IN_DISKLABEL) return; if (get_buffer(section, 0, 512, (void **)&buf) == 512) { if (get_le_short(buf + 0x1b0) == 0xbb66) { print_line(level, "FreeBSD boot manager (i386 boot0 at sector 0)"); } else if (get_le_long(buf + 0x1f6) == 0 && get_le_long(buf + 0x1fa) == 50000 && get_le_short(buf + 0x1fe) == 0xaa55) { print_line(level, "FreeBSD boot loader (i386 boot1 at sector 0)"); } } if (get_buffer(section, 1024, 512, (void **)&buf) == 512) { if (memcmp(buf + 2, "BTX", 3) == 0) { print_line(level, "FreeBSD boot loader (i386 boot2/BTX %d.%02d at sector 2)", (int)buf[5], (int)buf[6]); } }}/* * Solaris SPARC disklabel */void detect_solaris_disklabel(SECTION *section, int level) { unsigned char *buf; int i, off1, off2, types[8], did_recurse; U32 sizes[8]; U64 starts[8], cylsize, offset; char s[256], append[256], pn; if (section->flags & FLAG_IN_DISKLABEL) return; if (get_buffer(section, 0, 512, (void **)&buf) < 512) return; if (get_be_short(buf + 508) != 0xDABE) return; print_line(level, "Solaris SPARC disklabel"); cylsize = (U64)get_be_short(buf + 436) * (U64)get_be_short(buf + 438); for (i = 0, off1 = 142, off2 = 444; i < 8; i++, off1 += 4, off2 += 8) { types[i] = get_be_short(buf + off1); starts[i] = get_be_long(buf + off2) * cylsize; sizes[i] = get_be_long(buf + off2 + 4); } /* loop over partitions: print and analyze */ did_recurse = 0; for (i = 0; i < 8; i++) { pn = '0' + i; if (sizes[i] == 0) continue; sprintf(append, " from %llu", starts[i]); format_blocky_size(s, sizes[i], 512, "sectors", append); print_line(level, "Partition %c: %s", pn, s); print_line(level + 1, "Type %d", types[i]); offset = starts[i] * 512; if (offset == 0) { print_line(level + 1, "Includes the disklabel"); /* recurse for content detection, but carefully */ analyze_recursive(section, level + 1, offset, (U64)sizes[i] * 512, FLAG_IN_DISKLABEL); did_recurse = 1; } else { /* recurse for content detection */ analyze_recursive(section, level + 1, offset, (U64)sizes[i] * 512, 0); } } if (did_recurse) stop_detect(); /* don't run other detectors; we already did that for the first partition, which overlaps with the disklabel itself. */}/* * Solaris x86 vtoc */static char * vtoctype_names[] = { "Unused", "Boot", "Root", "Swap", "Usr", "Overlap", "Stand", "Var", "Home", "Alternate sector", "Cache" };static char * get_name_for_vtoctype(int type) { if (type >= 0 && type <= 10) return vtoctype_names[type]; return "Unknown";}void detect_solaris_vtoc(SECTION *section, int level) { unsigned char *buf; int i, off, partcount, sectorsize, types[16], did_recurse; U32 starts[16], sizes[16]; U32 version; U64 offset; char s[256], append[64]; if (section->flags & FLAG_IN_DISKLABEL) return; if (get_buffer(section, 512, 512, (void **)&buf) < 512) return; if (get_le_long(buf + 12) != 0x600DDEEE) return; version = get_le_long(buf + 16); if (version != 1) { print_line(level, "Solaris x86 disklabel, unknown version %lu", version); return; } partcount = get_le_short(buf + 30); if (partcount > 16) { print_line(level, "Solaris x86 disklabel, version 1, %d partitions (limiting to 16)", partcount); partcount = 16; } else { print_line(level, "Solaris x86 disklabel, version 1, %d partitions", partcount); } sectorsize = get_le_short(buf + 28); if (sectorsize != 512) print_line(level + 1, "Unusual sector size %d bytes, your mileage may vary", sectorsize); get_string(buf + 20, 8, s); if (s[0]) print_line(level + 1, "Volume name \"%s\"", s); for (i = 0, off = 72; i < partcount; i++, off += 12) { types[i] = get_le_short(buf + off); starts[i] = get_le_long(buf + off + 4); sizes[i] = get_le_long(buf + off + 8); } /* loop over partitions: print and analyze */ did_recurse = 0; for (i = 0; i < partcount; i++) { if (sizes[i] == 0) continue; sprintf(append, " from %lu", starts[i]); format_blocky_size(s, sizes[i], 512, "sectors", append); print_line(level, "Partition %d: %s", i, s); print_line(level + 1, "Type %d (%s)", types[i], get_name_for_vtoctype(types[i])); offset = (U64)starts[i] * 512; if (offset == 0) { print_line(level + 1, "Includes the disklabel"); /* recurse for content detection, but carefully */ analyze_recursive(section, level + 1, offset, (U64)sizes[i] * 512, FLAG_IN_DISKLABEL); did_recurse = 1; } else { /* recurse for content detection */ analyze_recursive(section, level + 1, offset, (U64)sizes[i] * 512, 0); } } if (did_recurse) stop_detect(); /* don't run other detectors; we already did that for an overlapping partition. */}/* * QNX4 file system */void detect_qnx(SECTION *section, int level) { unsigned char *buf; if (get_buffer(section, 512, 512, (void **)&buf) < 512) return; /* check signature */ if (get_le_long(buf) != 0x0000002f) return; /* NOTE: This is actually the string "/", the file name of the root directory. QNX4 fs does not have a real superblock, just an aggregate of 4 inodes for certain special files. */ /* tell the user */ print_line(level, "QNX4 file system");}/* EOF */
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -