📄 linux.c
字号:
/* try to detect from first PE */ if (pe_start > 0) { rs.source = section->source; rs.pos = section->pos + pe_start; rs.size = 0; rs.flags = 0; info->next = dt_detect(&rs); /* TODO: elaborate on this by reading the PE allocation map */ } return DT_YES;}/* * Linux swap area */int detect_linux_swap(SECTION *section, DT_Info* info) { int i, en, pagesize; unsigned char *buf; U32 version, pages; int pagesizes[] = { 4096, 8192, 0 }; for (i = 0; pagesizes[i]; i++) { pagesize = pagesizes[i]; info->fs.volume_blocksize = pagesize; if (get_buffer(section, pagesize - 512, 512, (void **)&buf) != 512) break; /* assumes page sizes increase through the loop */ if (memcmp((char *)buf + 512 - 10, "SWAP-SPACE", 10) == 0) { info->fs.type = DT_LINUX_SWAP; info->fs.type_version = 1; info->fs.type_version_name = _T("Linux swap, version 1"); /* print_line(level, "Linux swap, version 1, %d KiB pages", pagesize >> 10); */ } else if (memcmp((char *)buf + 512 - 10, "SWAPSPACE2", 10) == 0) { if (get_buffer(section, 1024, 512, (void **)&buf) != 512) break; /* really shouldn't happen */ info->fs.type = DT_LINUX_SWAP; for (en = 0; en < 2; en++) { version = get_ve_long(en, buf); if (version >= 1 && version < 10) break; } if (en < 2) { info->fs.type_version = 2; info->fs.type_subversion = version; info->fs.type_version_name = _T("Linux swap, version 2"); /* print_line(level, "Linux swap, version 2, subversion %d, %d KiB pages, %s", (int)version, pagesize >> 10, get_ve_name(en)); */ if (version == 1) { pages = get_ve_long(en, buf + 4) - 1; info->fs.volume_blocks = pages; info->fs.volume_size = pages * pagesize; /* format_blocky_size(s, pages, pagesize, "pages", NULL); print_line(level + 1, "Swap size %s", s); */ } } else { info->fs.type_version = 2; info->fs.type_version_name = _T("Linux swap, version 2, illegal subversion"); /* print_line(level, "Linux swap, version 2, illegal subversion, %d KiB pages", pagesize >> 10); */ } } } if(info->fs.type == DT_LINUX_SWAP) { info->fs.type_name = strdup("swap"); return DT_YES; } else return DT_NO;}/* * various file systems */int detect_linux_misc(SECTION *section, DT_Info* info) { int magic, fill, off, en; unsigned char *buf; char s[256]; U64 size, blocks, blocksize; fill = get_buffer(section, 0, 2048, (void **)&buf); if (fill < 512) return DT_NO; /* minix file system */ if (fill >= 2048) { int version = 0, namesize = 14; magic = get_le_short(buf + 1024 + 16); if (magic == 0x137F) version = 1; if (magic == 0x138F) { version = 1; namesize = 30; } if (magic == 0x2468) version = 2; if (magic == 0x2478) { version = 2; namesize = 30; } if (version) { info->fs.type_version = version; info->fs.type_subversion = namesize; info->fs.type = DT_LINUX_MISC; info->fs.type_version_name = _T("Minix file system"); info->fs.type_name = strdup("minix"); /* print_line(level, "Minix file system (v%d, %d chars)", version, namesize); */ if (version == 1) blocks = get_le_short(buf + 1024 + 2); else blocks = get_le_long(buf + 1024 + 20); blocks = (blocks - get_le_short(buf + 1024 + 8)) << get_le_short(buf + 1024 + 10); info->fs.volume_blocksize = 1024; info->fs.volume_blocks = blocks; info->fs.volume_size = blocks * 1024; /* format_blocky_size(s, blocks, 1024, "blocks", NULL); print_line(level + 1, "Volume size %s", s); */ return DT_YES; } } /* Linux romfs */ if (memcmp(buf, "-rom1fs-", 8) == 0) { size = get_be_long(buf + 8); info->fs.type = DT_LINUX_MISC; info->fs.type_version_name = _T("Linux romfs"); info->fs.type_name = strdup("romfs"); info->fs.volume_name = strdup( (char*)(buf + 16) ); info->fs.volume_size = size; /* print_line(level, "Linux romfs"); print_line(level+1, "Volume name \"%.300s\"", (char *)(buf + 16)); format_size_verbose(s, size); print_line(level+1, "Volume size %s", s); */ return DT_YES; } /* Linux cramfs */ for (off = 0; off <= 512; off += 512) { if (fill < off + 512) break; for (en = 0; en < 2; en++) { if (get_ve_long(en, buf + off) == 0x28cd3d45) { info->fs.type = DT_LINUX_MISC; info->fs.type_version_name = _T("Linux cramfs"); info->fs.type_name = _T("cramfs"); get_string(buf + off + 48, 16, s); info->fs.volume_name = strdup(s); /* print_line(level, "Linux cramfs, starts sector %d, %s", off >> 9, get_ve_name(en)); print_line(level + 1, "Volume name \"%s\"", s); */ size = get_ve_long(en, buf + off + 4); blocks = get_ve_long(en, buf + off + 40); info->fs.volume_size = size; info->fs.volume_blocks = blocks; info->fs.volume_blocksize = 4096; /* format_size_verbose(s, size); print_line(level + 1, "Compressed size %s", s); format_blocky_size(s, blocks, 4096, "blocks", " -assumed-"); print_line(level + 1, "Data size %s", s); */ return DT_YES; } } } /* Linux squashfs */ for (en = 0; en < 2; en++) { if (get_ve_long(en, buf) == 0x73717368) { int major, minor; major = get_ve_short(en, buf + 28); minor = get_ve_short(en, buf + 30); info->fs.type = DT_LINUX_MISC; info->fs.type_version = major; info->fs.type_subversion = minor; info->fs.type_version_name = _T("Linux squashfs"); info->fs.type_name = strdup("squashfs"); /* print_line(level, "Linux squashfs, version %d.%d, %s", major, minor, get_ve_name(en)); */ size = get_ve_long(en, buf + 8); blocksize = get_ve_short(en, buf + 32); info->fs.volume_size = size; info->fs.volume_blocksize = blocksize; /* format_size_verbose(s, size); print_line(level + 1, "Compressed size %s", s); format_size(s, blocksize); print_line(level + 1, "Block size %s", s); */ return DT_YES; } } return DT_NO;}/* * various boot code signatures */int detect_linux_loader(SECTION *section, DT_Info* info) { int fill, executable, id; unsigned char *buf; if (section->flags & FLAG_IN_DISKLABEL) return DT_NO; fill = get_buffer(section, 0, 2048, (void **)&buf); if (fill < 512) return DT_NO; executable = (get_le_short(buf + 510) == 0xaa55) ? 1 : 0; /* boot sector stuff */ if (executable && memcmp(buf + 2, "LILO", 4) == 0) { info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("LILO"); /* print_line(level, "LILO boot code"); */ return DT_YES; } if (executable && memcmp(buf + 3, "SYSLINUX", 8) == 0) { info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("SYSLINUX"); /* print_line(level, "SYSLINUX boot code"); */ return DT_YES; } if (fill >= 1024 && find_memory(buf, 1024, "ISOLINUX", 8) >= 0) { info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("ISOLINUX"); /*print_line(level, "ISOLINUX boot code"); */ return DT_YES; } /* we know GRUB a little better now... */ if (executable && find_memory(buf, 512, "Geom\0Hard Disk\0Read\0 Error\0", 27) >= 0) { info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("GRUB"); if (buf[0x3e] == 3) { info->bootcode.loader_version = (int)buf[0x3e]; info->bootcode.loader_subversion = (int)buf[0x3f]; info->bootcode.loader_bootdrive = (int)buf[0x40]; /* print_line(level, "GRUB boot code, compat version %d.%d, boot drive 0x%02x", (int)buf[0x3e], (int)buf[0x3f], (int)buf[0x40]); */ } else if (executable && buf[0x1bc] == 2 && buf[0x1bd] <= 2) { id = buf[0x3e]; if (id == 0x10) { info->bootcode.loader_version = (int)buf[0x1bc]; info->bootcode.loader_subversion = (int)buf[0x1bd]; info->bootcode.loader_version_string = _T("normal version"); /* print_line(level, "GRUB boot code, compat version %d.%d, normal version", (int)buf[0x1bc], (int)buf[0x1bd]); */ } else if (id == 0x20) { info->bootcode.loader_version = (int)buf[0x1bc]; info->bootcode.loader_subversion = (int)buf[0x1bd]; info->bootcode.loader_version_string = _T("LBA version"); /* print_line(level, "GRUB boot code, compat version %d.%d, LBA version", (int)buf[0x1bc], (int)buf[0x1bd]); */ } else { info->bootcode.loader_version = (int)buf[0x1bc]; info->bootcode.loader_subversion = (int)buf[0x1bd]; /* print_line(level, "GRUB boot code, compat version %d.%d", (int)buf[0x1bc], (int)buf[0x1bd]); */ } } else { info->bootcode.loader_version = buf[0x3e]; info->bootcode.loader_version_string = _T("unknown version"); /* print_line(level, "GRUB boot code, unknown compat version %d", buf[0x3e]); */ } return DT_YES; } /* Linux kernel loader */ if (fill >= 1024 && memcmp((char *)buf + 512 + 2, "HdrS", 4) == 0) { info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("Linux kernel built-in loader"); /* print_line(level, "Linux kernel build-in loader"); */ return DT_YES; } /* Debian install floppy splitter */ /* (not exactly boot code, but should be detected before gzip/tar */ if (memcmp(buf, "Floppy split ", 13) == 0) { char *name = (char *)buf + 32; char *number = (char *)buf + 164; char *total = (char *)buf + 172; info->bootcode.type = DT_LINUX_LOADER; info->bootcode.loader = _T("Debian Install Floppy Splitter"); info->bootcode.loader_version = atoi(number); info->bootcode.loader_subversion = atoi(total); info->bootcode.loader_version_string = strdup(name); /* print_line(level, "Debian floppy split, name \"%s\", disk %s of %s", name, number, total); */ return DT_YES; } return DT_NO;}/* EOF */
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -